This vulnerability in axiomthemes Marveland (<= 1.3.0) arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, impacting confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in an attacker executing arbitrary code on the affected server, accessing sensitive files, or causing denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls to detect and block malicious requests, and monitoring for suspicious activity related to file inclusion attempts.