This vulnerability involves improper control over the filename used in PHP include or require statements within the jwsthemes Issabella product, enabling PHP Local File Inclusion. The issue affects versions up to 1.1.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially exposing sensitive information, modifying application behavior, or causing denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious requests related to file inclusion. Monitor vendor channels for updates and patches.