This vulnerability in scripteo Ads Pro affects versions up to 4.89 and arises from improper validation of filenames used in PHP include or require statements. This improper control can be exploited to perform Local File Inclusion (LFI), allowing an attacker to read sensitive files or execute arbitrary code depending on the server configuration. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required. No patch or vendor advisory details are currently provided.

Successful exploitation can lead to disclosure of sensitive information, code execution, and disruption of service on affected installations of scripteo Ads Pro. The high CVSS score indicates that the vulnerability poses a serious risk to affected systems. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious requests related to file inclusion attempts. Monitor vendor channels for updates.