The vulnerability CVE-2025-69100 in the fuelthemes North WordPress theme arises from improper control of the filename parameter in PHP include or require statements, enabling Local File Inclusion (LFI). This allows an attacker to include files from the local filesystem, which can lead to sensitive data exposure or remote code execution depending on the context. The issue affects all versions up to 5.7.5. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been disclosed yet, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include arbitrary local files on the server running the vulnerable North theme, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score indicates a serious risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or applying manual code review and hardening to restrict file inclusion paths. Monitor vendor channels for updates and patches.