The vulnerability CVE-2025-69339 affects don-themes Molla up to version 1.5.16 and is characterized by improper control of filenames used in PHP include or require statements. This weakness can lead to PHP Local File Inclusion, where an attacker may cause the application to load unintended local files, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running don-themes Molla. This can result in unauthorized code execution, data leakage, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider restricting access to vulnerable endpoints and applying general PHP hardening measures relevant to file inclusion vulnerabilities.