This vulnerability in ThemeMove EduMall arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all releases up to and including 4.4.7. The issue allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive information remotely over the network. The CVSS 3.1 vector indicates high complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No patch or vendor advisory details are currently available.

Successful exploitation could lead to remote code execution or unauthorized access to sensitive files, severely compromising the confidentiality, integrity, and availability of the affected system. The vulnerability requires network access and low privileges but no user interaction. There are no known active exploits reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks.