This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the CasaMia WordPress theme. Specifically, it allows PHP Local File Inclusion, where an attacker can cause the application to include files from the local filesystem that should not be accessible. The affected versions are all versions up to and including 1.1.2. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The impact is rated high due to the potential full compromise of the affected system's confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available from the vendor or other authoritative sources. Patch status is not yet confirmed — check the vendor advisory or AncoraThemes updates for current remediation guidance. Until a fix is provided, users should consider disabling or removing the vulnerable theme or restricting access to the affected application to trusted users only.