This vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons (up to version 2.1.12) is due to improper control of filenames in PHP include/require statements, enabling remote file inclusion. The CVSS 3.1 score is 6.5 (medium), with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and resulting in high confidentiality impact without affecting integrity or availability. No known exploits in the wild or patches have been reported yet.

An attacker with low privileges can exploit this vulnerability remotely to include arbitrary remote files, potentially leading to disclosure of sensitive information. The impact is limited to confidentiality with no direct integrity or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for updates from RadiusTheme. Avoid exposing the plugin to untrusted networks or users with low privileges.