This vulnerability in ThimPress BuilderPress arises from improper validation of filenames used in PHP include or require statements, enabling an attacker to perform Local File Inclusion (LFI). Exploiting this flaw can allow an attacker to execute arbitrary code, read sensitive files, or disrupt system operations. The issue affects all versions up to 2.0.1. The CVSS 3.1 vector indicates it is remotely exploitable without authentication or user interaction, with critical impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to remote code execution, unauthorized disclosure of sensitive information, and denial of service conditions on affected installations of BuilderPress. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable component and monitor for updates from ThimPress. No vendor advisory or patch links are currently available.