This vulnerability in Elated-Themes Gioia theme versions up to 1.4 arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector and no privileges required. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation can result in full compromise of the affected web server, including execution of arbitrary code, disclosure of sensitive files, and denial of service. The vulnerability affects all installations of Gioia theme version 1.4 and earlier. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected theme or restricting access to vulnerable endpoints if possible. Monitor official Elated-Themes communications for updates.