This vulnerability in Select-Themes SetSail (versions up to 1.8) arises from improper validation or control of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, where an attacker can cause the application to include unintended local files. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

Successful exploitation could allow an attacker to read or execute arbitrary local files on the server running the vulnerable SetSail application. This can lead to disclosure of sensitive information, modification of application behavior, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts.