This vulnerability arises from improper validation of filenames used in PHP include or require statements within the DeluxeThemes Private Messages for UserPro plugin. An attacker could exploit this flaw to perform remote file inclusion, potentially executing arbitrary code on the affected system. The issue affects all versions up to and including 4.10.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could result in remote code execution, compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access, data disclosure, and disruption of service. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor official DeluxeThemes channels for updates and apply patches promptly once released.