This vulnerability, identified as CWE-98, arises from improper control of filenames in include or require statements within the PHP code of ThemeREX Resurs. It allows unauthenticated attackers to perform Local File Inclusion (LFI) on Resurs versions <= 1.3. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable installations and consider applying temporary mitigations such as disabling vulnerable functionality or restricting file inclusion paths if possible.