This vulnerability in Elated-Themes Helvig arises from improper control of the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). The issue affects Helvig versions up to 1.0. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability. No patch or official fix information is available from the vendor or advisory sources.

Successful exploitation allows an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, and full system compromise. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected Helvig theme or applying manual code review and hardening to prevent unsafe file inclusion. Monitor vendor channels for updates.