The vulnerability CVE-2025-69402 in ThemeREX R&F arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw affects versions up to and including 1.5. The CVSS score of 8.1 indicates high impact with network attack vector, high confidentiality, integrity, and availability impacts, and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing attackers to read sensitive files, execute arbitrary code, or disrupt service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions and applying general PHP hardening practices specific to include/require statements. Avoid using untrusted input in file inclusion functions. Monitor vendor channels for updates.