This vulnerability arises from improper validation or control over filenames used in PHP include or require statements within the CraftXtore product by BZOTheme. Such improper control enables an attacker to perform Local File Inclusion (LFI), potentially allowing arbitrary file inclusion from the local filesystem. The vulnerability affects versions up to and including 1.7. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, and denial of service, impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is considered severe. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Avoid exposing the affected application to untrusted networks where possible.