The vulnerability CVE-2026-25457 affects the Select-Themes Mixtape product up to version 2.1. It arises from improper control over the filename used in PHP include or require statements, enabling a Local File Inclusion (LFI) attack. This can allow an attacker to read sensitive files or execute arbitrary code depending on the server configuration. The CVSS 3.1 base score is 8.1 with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on affected systems running vulnerable versions of Mixtape. The high CVSS score reflects the potential for severe impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Select-Themes communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include requests may help mitigate risk.