The dedalx InHype WordPress theme up to version 1.5.2 contains a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control allows local file inclusion, enabling attackers to execute arbitrary local files on the server. The vulnerability is classified as high severity with a CVSS 3.1 score of 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the vulnerability is not related to a cloud service. No known active exploitation has been reported.

Successful exploitation of this vulnerability could lead to execution of arbitrary local files on the affected server, potentially compromising confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify content, or disrupt service. The high CVSS score reflects the severity of these impacts. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints to reduce risk. Monitor official dedalx communications for updates and apply patches promptly once available.