The vulnerability CVE-2024-50436 affects the themehorse Clean Retina WordPress theme through improper control of filenames in PHP include/require statements, enabling remote file inclusion. This allows an attacker to potentially execute arbitrary code remotely by manipulating the filename parameter. The issue affects Clean Retina versions up to and including 3.0.6. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor or other sources.

Successful exploitation of this vulnerability could lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. This could allow attackers to execute arbitrary code, inject malicious payloads, or disrupt service. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme if possible, or restrict access to the vulnerable functionality to trusted users only. Monitor official themehorse communications for updates and apply patches promptly once available.