This vulnerability, identified as CWE-98, involves improper control of filenames in include or require statements within the PHP-based ThemeREX Line Agency product. Specifically, versions up to and including 1.3.1 are affected by an unauthenticated Local File Inclusion flaw. An attacker can exploit this to include arbitrary local files on the server, which can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no vendor patch or official remediation is currently documented.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker can include arbitrary local files, potentially executing malicious code or accessing sensitive data without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and consider implementing web application firewall (WAF) rules to detect and block attempts to exploit Local File Inclusion. Monitor for updates from ThemeREX regarding patches or official mitigations.