This vulnerability in Elated-Themes Frappé arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all releases up to and including 1.8. The vulnerability allows an unauthenticated attacker to include local files on the server, which may result in remote code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can lead to full compromise of the affected system, including arbitrary code execution and disclosure of sensitive data. The vulnerability affects confidentiality, integrity, and availability of the system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality or applying other protective controls as recommended by the vendor once available.