This vulnerability (CVE-2025-69109) in ThemeREX Raider Spirit (<=1.1.2) is an unauthenticated Local File Inclusion (LFI) flaw caused by improper control of filenames in PHP include/require statements (CWE-98). It enables remote attackers to include local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been documented as of the published date.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers can include arbitrary local files, potentially exposing sensitive data, executing malicious code, or causing denial of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds such as disabling vulnerable functionality or restricting access to affected components if possible. Monitor official ThemeREX communications for updates.