This vulnerability (CWE-98) in ThemeREX Rosaleen involves improper control of filenames used in include or require statements in PHP, enabling unauthenticated attackers to perform local file inclusion. The issue affects Rosaleen versions up to and including 2.8. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to include and execute arbitrary local files on the server running the vulnerable Rosaleen theme, potentially leading to full system compromise including disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable installations and consider disabling or removing the affected theme if feasible.