This vulnerability is an unauthenticated Local File Inclusion (LFI) in ThemeREX Snow Club versions <= 1.1. It arises from improper control of filenames used in PHP include or require statements, allowing an attacker to include arbitrary local files. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided by the vendor or advisory, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the server running Snow Club <= 1.1. This can lead to full compromise of the system's confidentiality, integrity, and availability, potentially allowing data disclosure, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable application to untrusted networks. Follow vendor updates closely for any forthcoming patches or official mitigations.