This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the Elated-Themes Savory theme. Remote attackers can exploit this to include and execute malicious remote files, resulting in remote code execution. The affected versions are up to and including 2.5. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. This can result in full system compromise, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints. Monitor official Elated-Themes communications for updates and patches.