This vulnerability in unfoldwp Magze (<= 1.0.9) arises from improper validation of filenames used in PHP include/require statements, enabling PHP Local File Inclusion. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The flaw allows attackers to execute unauthorized file inclusions, which can lead to remote code execution or data exposure depending on the included files.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files by including local files through the vulnerable PHP include/require statements. This poses a significant risk to systems running affected versions of Magze.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the affected functionality or applying custom input validation to control filenames used in include/require statements. Monitor unfoldwp's official channels for updates and patches.