The vulnerability CVE-2025-69396 affects ThemeREX Splendour versions up to 1.23 and is caused by improper validation of filenames used in PHP include or require statements. This improper control can be exploited to perform PHP Local File Inclusion, potentially allowing an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory information is available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, leading to remote code execution or disclosure of sensitive information. The high CVSS score indicates that confidentiality, integrity, and availability of the affected system could be severely compromised. There are currently no known exploits in the wild, but the vulnerability presents a serious risk if left unmitigated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable components, applying web application firewall rules to block malicious input targeting include/require statements, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.