This vulnerability in axiomthemes Lab arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. The affected versions are up to 1.0.0. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the vulnerable PHP application. This can lead to disclosure of sensitive information, code execution, and potential full system compromise affecting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application, applying web application firewall rules to block suspicious requests, and auditing include/require usage in the codebase to implement proper input validation and sanitization.