This vulnerability (CVE-2025-69117) affects ThemeREX Ingenioso versions <= 1.14.0 and is categorized as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Programs, commonly known as a PHP Remote File Inclusion or Local File Inclusion issue. The flaw allows unauthenticated attackers to perform Local File Inclusion, which can lead to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability can result in an attacker including and executing arbitrary local files on the server without authentication. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 8.1 indicates a high impact with network attack vector, high complexity, no privileges required, no user interaction, and unchanged scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations, applying web application firewalls with rules targeting LFI attempts, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing vulnerable versions to untrusted networks.