This vulnerability in ThemeMove EduMall (versions before 4.4.5) arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows PHP Local File Inclusion, enabling an attacker to include and execute arbitrary local files on the server. The CVSS v3.1 score of 8.1 indicates a high impact with network attack vector, high complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official fix details are currently available from the vendor or advisory sources.

Successful exploitation can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the server. This compromises confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is significant, potentially enabling full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include/require requests, and limiting file permissions to reduce potential impact.