This vulnerability in Kentha Elementor Widgets arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). The affected versions are all versions before 3.1. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch links or vendor advisories are available to confirm remediation status.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The vulnerability affects confidentiality, integrity, and availability with high severity. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or restricting access to trusted users only. Monitor official QantumThemes communications for updates and patches.