The vulnerability CVE-2026-25381 in jwsthemes LoveDate is caused by improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion. This allows an attacker to cause the application to include arbitrary local files, which can lead to remote code execution or disclosure of sensitive information. The issue affects versions before 3.8.6. The CVSS score is 8.1, indicating a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code or access sensitive files on the server running the vulnerable LoveDate application. This compromises confidentiality, integrity, and availability of the system. The high CVSS score reflects the significant potential impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor jwsthemes communications for updates. Until a fix is available, restricting access to the vulnerable application and employing web application firewalls to detect and block suspicious include requests may help mitigate risk.