This vulnerability (CVE-2025-69121) involves improper control of filenames used in include or require statements within the PHP-based ThemeREX Deliciosa product. Specifically, unauthenticated attackers can exploit local file inclusion in versions up to and including 1.10.0, potentially allowing them to execute arbitrary code or access sensitive files. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor ThemeREX advisories for updates. Until a patch is available, restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious file inclusion attempts may help mitigate risk.