This vulnerability in Select-Themes Prowess arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) flaw. The issue affects all versions up to 1.8.1. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory details are provided, and the product is not a cloud service, so remediation must be managed by the user.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary files on the affected server, leading to full compromise of the system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or denial of service. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Select-Themes advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying strict input validation on filename parameters if possible.