This vulnerability (CVE-2025-69144) affects ThemeREX Preservation software versions <= 1.10. It is classified as CWE-98, indicating improper control of filenames in include or require statements in PHP programs, commonly known as a remote file inclusion or local file inclusion vulnerability. The flaw allows unauthenticated attackers to perform local file inclusion, which can lead to remote code execution or other severe impacts. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. An attacker can include arbitrary files, potentially executing malicious code remotely without authentication. This can lead to data disclosure, data modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable application to untrusted networks.