This vulnerability (CVE-2025-69173) is classified as CWE-98, indicating improper control of filenames used in PHP include or require statements. It affects ThemeREX Tipsy versions up to and including 1.1. The flaw allows unauthenticated attackers to perform local file inclusion, which can lead to remote code execution or disclosure of sensitive information. The CVSS v3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided as of the published date.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive files, execution of arbitrary code, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application, apply web application firewall (WAF) rules to block suspicious include requests, and monitor for exploitation attempts. Avoid exposing the vulnerable application to untrusted networks.