The vulnerability CVE-2024-52386 affects RadiusTheme Classified Listing versions up to 3.1.16. It arises from improper control over the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with network access and low privileges to read sensitive files on the server, impacting confidentiality. The CVSS score is 5.3 (medium), reflecting the network attack vector, high attack complexity, low privileges required, no user interaction, and confidentiality impact only. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files on the affected system, compromising confidentiality. There is no impact on integrity or availability. The attack requires network access and low privileges, with high attack complexity, limiting ease of exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected application and review file inclusion configurations to prevent local file inclusion. Avoid exposing the vulnerable component to untrusted users. Monitor vendor channels for updates.