The vulnerability CVE-2025-69395 in ThemeREX Gable theme arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include unintended files from the local filesystem, potentially resulting in arbitrary code execution or information disclosure. The issue affects versions up to and including 1.5 of the Gable theme. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation can lead to full compromise of the affected web server by allowing an attacker to execute arbitrary code or access sensitive files. This impacts confidentiality, integrity, and availability of the system. Given the high CVSS score and nature of the vulnerability, the risk to affected installations is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to vulnerable endpoints. Monitor ThemeREX communications for updates and apply patches promptly once available.