The vulnerability CVE-2026-24531 in Select-Themes Prowess is due to improper control of the filename parameter in PHP include/require statements, resulting in a Local File Inclusion (LFI) flaw. This allows an attacker with low privileges to potentially include unintended files, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions include all versions up to 2.3. No official patch or vendor advisory is currently available.

Successful exploitation could lead to disclosure of sensitive information, unauthorized code execution, and service disruption. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and review PHP include/require usage to prevent unsafe file inclusion. Avoid exposing the application to untrusted input that controls file paths.