This vulnerability, classified as CWE-98, arises from improper control of filenames in PHP include/require statements in ThemeREX WineShop. It allows unauthenticated attackers to perform Local File Inclusion (LFI) on WineShop versions up to 3.17, enabling them to include arbitrary files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to arbitrary file inclusion on the server, which may allow attackers to execute malicious code, disclose sensitive information, or disrupt service. The CVSS score indicates high impact on confidentiality, integrity, and availability, meaning a full compromise of the affected system is possible if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor ThemeREX advisories for updates. Until a patch is available, restricting access to the vulnerable application and employing web application firewalls to detect and block suspicious include requests may help mitigate risk.