This vulnerability (CWE-98) in Favethemes Houzez arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. It affects versions before 4.1.4. The vulnerability allows an attacker with low privileges to include local files, potentially exposing sensitive information. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

An attacker with low privileges can exploit this vulnerability to include local files on the server, potentially disclosing sensitive information. There is no indication of integrity or availability impact. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor Favethemes advisories for updates. Until a fix is available, restricting file inclusion paths and applying strict input validation on filename parameters may help mitigate risk.