This vulnerability (CVE-2025-69158) affects ThemeREX Granola versions <=1.13 and is categorized as CWE-98, indicating improper control of filenames used in PHP include or require statements. The flaw allows unauthenticated attackers to perform local file inclusion, which can lead to remote code execution. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or authoritative sources. There are no known exploits in the wild at this time.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. Because the vulnerability is exploitable without authentication, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable components or applying workarounds recommended by the vendor if available. Monitoring vendor channels for updates is strongly advised.