This vulnerability arises from improper validation or control of filenames in PHP include or require statements within the Extensive VC Addons for WPBakery page builder plugin. Specifically, it allows a local file inclusion attack, where an attacker can cause the application to include files from the local filesystem. This can lead to disclosure of sensitive information or code execution depending on the included files. The issue affects all versions up to 1.9.1. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files on the server, potential code execution, and full compromise of the affected web application. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Nenad Obradovic's advisories or the plugin's update channels for any released fixes. Until a patch is available, consider disabling or removing the affected plugin to mitigate risk.