This vulnerability, classified as CWE-98, arises from improper control of filenames used in PHP include or require statements in the ThemeREX Food Drop product. Specifically, unauthenticated attackers can exploit this Local File Inclusion flaw in versions up to and including 1.3 to execute arbitrary code or access sensitive files. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to include local files, potentially leading to remote code execution, data disclosure, and full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor ThemeREX advisories for updates and consider restricting access or disabling vulnerable functionality until a patch is available.