This vulnerability, identified as CWE-98, arises from improper control of filenames in include or require statements within the PHP code of AxiomThemes Reprizo. Specifically, unauthenticated attackers can exploit this Local File Inclusion (LFI) flaw in versions up to 1.0.8 to include arbitrary local files. The CVSS 3.1 base score of 8.1 reflects the network attack vector, high impact on confidentiality, integrity, and availability, and the lack of required privileges or user interaction. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. Because the vulnerability is unauthenticated and remotely exploitable over the network, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include requests, and monitoring for unusual file access patterns. Avoid exposing the vulnerable application to untrusted networks where possible.