This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements within the PHP-based ThemeREX Quirky product. It allows an unauthenticated attacker to perform local file inclusion (LFI), potentially leading to remote code execution. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The affected versions are Quirky versions up to and including 1.23. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks where possible.