This vulnerability in quomodosoft Shopready's shopready-elementor-addon arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to complete system compromise. The affected versions include all versions up to and including 3.6. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and low privileges required.

Successful exploitation can lead to disclosure of sensitive files, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. Given the local file inclusion nature, attackers may read arbitrary files or execute code depending on server configuration. The vulnerability is rated high severity with a CVSS score of 7.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict network access to the affected application and monitor for suspicious activity related to file inclusion attempts.