This vulnerability arises from insufficient validation of filenames in PHP include or require statements within the Simple Payment application by Ido Kobelkowsky. Remote File Inclusion vulnerabilities allow attackers to supply a remote file path that the application then includes and executes, potentially leading to full system compromise. The affected versions are up to and including 2.4.6. The CVSS vector indicates the attack requires network access, has high complexity, no privileges required, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow remote attackers to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. This could lead to data theft, system manipulation, or denial of service. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application, applying web application firewall rules to block suspicious include requests, and avoiding exposure of vulnerable versions to untrusted networks. Monitor vendor channels for updates and patches.