This vulnerability (CWE-98) in CactusThemes VideoPro arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion attacks. The affected versions include all releases up to 2.3.8.1. Successful exploitation could allow an attacker to include arbitrary local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can result in an attacker executing arbitrary code or accessing sensitive files on the affected system, severely compromising system confidentiality, integrity, and availability. Given the high CVSS score (8.1), the impact is considered high, potentially allowing full system compromise.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying workarounds such as disabling vulnerable functionality if possible or restricting access to the affected application to trusted networks only.