The vulnerability CVE-2026-24608 affects the Laurent Core plugin by Elated-Themes and is characterized by improper control of the filename parameter in PHP include or require statements. This weakness enables a PHP Local File Inclusion attack, where an attacker with limited privileges can cause the application to include unintended local files. The vulnerability impacts all versions up to and including 2.4.1. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. No patch or official remediation guidance is currently documented.

Successful exploitation of this vulnerability could allow an attacker with low privileges to read or execute arbitrary local files on the affected server, potentially leading to full compromise of the system's confidentiality, integrity, and availability. This could result in unauthorized data disclosure, modification, or denial of service. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor Elated-Themes' official channels for updates and apply patches promptly once available.