This vulnerability in Select-Themes Stockholm arises from improper validation or control of filenames in PHP include/require statements, enabling Local File Inclusion (LFI). The affected versions are up to 9.14.1. The CVSS 3.1 score is 7.5, indicating a high severity with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor patch or advisory details are currently available.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict file inclusion mechanisms in the affected application and apply best practices for input validation to mitigate risk.