This vulnerability in stmcan RT-Theme 18 | Extensions (up to version 2.4) arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. An attacker could exploit this flaw to include local files on the server, potentially exposing sensitive information or executing arbitrary code. The CVSS 3.1 score of 7.5 reflects a high-severity issue with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation can lead to local file inclusion, which may disclose sensitive files or enable code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.5. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates and apply patches promptly once released.