This vulnerability in InfornWeb News & Blog Designer Pack arises from improper validation or control over filenames passed to PHP include or require statements. Such a flaw enables an attacker to perform Local File Inclusion (LFI), potentially allowing them to execute arbitrary code or access sensitive files on the server. The affected versions include all releases up to and including 4.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files locally on the server hosting the vulnerable application. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until a patch is available, restricting access to the vulnerable application and employing web application firewalls to detect suspicious requests may help reduce risk.