This vulnerability (CWE-98) in Themeum Right Way versions <= 4.0 allows unauthenticated attackers to exploit improper control of filenames in PHP include/require statements, resulting in local file inclusion. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability with network attack vector but requiring high attack complexity and no privileges or user interaction. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

Successful exploitation can lead to remote code execution, full system compromise including confidentiality, integrity, and availability impacts. Since the vulnerability is unauthenticated, attackers do not need credentials to exploit it. The high CVSS score indicates serious risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and consider applying temporary mitigations such as disabling vulnerable functionality or using web application firewalls to block malicious requests targeting file inclusion.