This vulnerability (CVE-2025-69120) is classified as CWE-98, involving improper control of filenames used in PHP include or require statements, resulting in a remote file inclusion flaw. It affects ThemeREX Dazzle versions <= 1.0.0. The vulnerability allows an unauthenticated attacker to perform local file inclusion, potentially leading to remote code execution or other severe impacts. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and disruption of service. Because the flaw allows unauthenticated local file inclusion, attackers may execute arbitrary code or access sensitive files on the server running the vulnerable ThemeREX Dazzle software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying other environment-specific mitigations to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.