This vulnerability arises from insufficient validation or control over filenames used in PHP include or require statements within the Pop-Up Chop Chop application. It allows a local file inclusion attack, which can lead to unauthorized disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected product is not a cloud service, and no patch or mitigation guidance is currently available from the vendor.

Successful exploitation can lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires network access and low privileges but no user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application to trusted users and environments. Avoid exposing the vulnerable application to untrusted networks. Monitor for updates from the vendor or security advisories regarding patches or mitigations.