This vulnerability in BZOTheme Zenny arises from improper validation or control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The issue affects all versions up to 1.7.5. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges or user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service. The vulnerability impacts confidentiality, integrity, and availability with a high severity rating (CVSS 8.1). No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the vulnerable theme and avoid exposing affected systems to untrusted networks. Monitor vendor channels for updates and apply patches promptly once released.