This vulnerability in axiomthemes Critique allows improper control over the filename parameter in PHP include/require statements, resulting in PHP Local File Inclusion. This can enable attackers to execute arbitrary code or disclose sensitive information by including unintended files. The affected product versions are up to and including 1.17. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to arbitrary file inclusion. This may allow attackers to execute arbitrary code or access sensitive files on the server running the vulnerable PHP application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the affected application and applying any available workarounds recommended by the vendor once published.