The RadiusTheme Classified Listing plugin versions up to 4.2.0 contain a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control results in a Local File Inclusion vulnerability, allowing an attacker with low privileges and no user interaction to include local files on the server. The vulnerability has a high attack complexity and impacts confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Applying strict input validation or disabling vulnerable functionality may reduce risk but should be guided by vendor recommendations.