This vulnerability arises from improper validation or control over filenames used in PHP include or require statements within the 'License For Envato' software. Such improper control can lead to Local File Inclusion (LFI), where an attacker can cause the application to include files from the local filesystem. The vulnerability affects all versions up to 1.0.0 of the product. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and user interaction.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, and potentially full system compromise due to the high impact on confidentiality, integrity, and availability. The attacker does not require privileges but must trick a user into interacting with a crafted request. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application, applying web application firewall rules to detect and block suspicious include requests, and avoid exposing the application to untrusted users. Monitor vendor channels for updates and patches.