This vulnerability in ThimPress BuilderPress (versions up to 2.0.1) arises from improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. An attacker could exploit this to include unintended files, potentially executing arbitrary code or accessing sensitive information. The CVSS 3.1 score of 9.8 reflects its critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution or unauthorized disclosure of sensitive files on the affected system, severely compromising the confidentiality, integrity, and availability of the application and underlying system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying any recommended temporary mitigations from the vendor. Monitor the vendor's communications for updates on patches or official fixes.