This vulnerability, identified as CWE-98, arises from improper control of filenames used in PHP include or require statements within ThemeREX Fortius software. Specifically, versions up to 2.3.0 are affected by an unauthenticated local file inclusion flaw. An attacker can exploit this to include arbitrary local files on the server, which may lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. Because the flaw is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.