This vulnerability in PowerPack Lite for Beaver Builder arises from insufficient validation of filenames used in PHP include or require statements, enabling remote file inclusion (RFI). Versions up to and including 1.3.0.3 are affected. The CVSS 3.1 score is 4.9 (medium), reflecting network attack vector, low attack complexity, required privileges at high level, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No vendor advisory or patch links are provided, and it is not a cloud service.

An attacker with high privileges on the affected system could exploit this vulnerability to include remote files, potentially leading to unauthorized disclosure of sensitive information. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users with appropriate privileges and monitor for suspicious activity related to file inclusion. Avoid exposing the vulnerable component to untrusted networks.