This vulnerability in Qode Essential Addons arises from improper validation of filenames used in PHP include or require statements, enabling remote file inclusion. Versions up to and including 1.6.3 are affected. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to include and execute remote malicious PHP code on the server hosting Qode Essential Addons, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in data theft, unauthorized system control, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or restricting access to the affected functionality to trusted users only.