This vulnerability in ThemeREX ConFix arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. It affects versions up to and including 1.013. Exploitation could allow an attacker to execute arbitrary code by including local files, impacting confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 8.1, reflecting network attack vector with high complexity and no privileges or user interaction required. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the affected system. This compromises confidentiality, integrity, and availability of the application and potentially the underlying server. The high CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and applying general PHP hardening practices relevant to file inclusion vulnerabilities.