This vulnerability (CVE-2025-69166) affects ThemeREX Gunslinger versions <=1.7 and is categorized as CWE-98: Improper Control of Filename for Include/Require Statement in PHP. It enables unauthenticated local file inclusion, allowing attackers to include and execute arbitrary files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level has been provided by the vendor or advisory sources as of the publication date.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and disruption of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and consider disabling or isolating the affected functionality to reduce exposure.