The RadiusTheme Metro product up to version 2.13 suffers from a PHP Local File Inclusion vulnerability due to improper control of filenames used in include/require statements. This can allow an attacker to include and execute local files on the server, leading to potential remote code execution or data disclosure. The vulnerability is remotely exploitable without privileges or user interaction but requires a high attack complexity. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code or access sensitive files on the affected system, compromising confidentiality, integrity, and availability. This could lead to full system compromise depending on the server configuration and the files accessible via the inclusion flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable functionality and apply strict input validation or filtering on filename parameters if possible.