The vulnerability CVE-2024-54376 in Spider Themes EazyDocs arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The affected versions are up to and including 2.8.0. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, low privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files on the server, potentially executing arbitrary code or accessing sensitive information. The vulnerability is exploitable remotely over the network with low privileges, making it a significant risk to affected installations.

Patch status is not yet confirmed — no official patch or vendor advisory is currently available. Users should monitor the vendor's communications for updates and apply any official fixes once released. Until then, restricting network access to the affected application and applying general PHP security best practices may reduce exposure but do not fully mitigate the vulnerability.