This vulnerability in istmoplugins Users Control (versions up to 1.0.16) involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This flaw allows an attacker to include local files via PHP Local File Inclusion, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to include and execute arbitrary local files on the server, leading to complete compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data disclosure, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected component, applying web application firewall rules to detect and block path traversal attempts, and limiting file permissions to reduce potential impact.