This vulnerability in axiomthemes Paragon involves improper control of the filename parameter in PHP include or require statements, enabling PHP Local File Inclusion. It affects versions up to 1.1. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available workarounds from the vendor. Monitor official channels for updates.