The vulnerability CVE-2025-69396 affects ThemeREX Splendour theme versions up to 1.23 and is caused by improper validation of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, potentially allowing attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation details are provided in the available data, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to remote code execution, disclosure of sensitive information, and full compromise of the affected web server running the vulnerable ThemeREX Splendour theme. The high CVSS score (8.1) confirms the critical nature of the impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to affected PHP files to mitigate exploitation risk. Monitor official ThemeREX channels for updates and patches.