This vulnerability in ThemeREX Justitia arises from insufficient validation of filenames used in PHP include or require statements, enabling local file inclusion attacks. It affects all versions up to and including 1.1.0. Exploitation could allow an attacker to include arbitrary local files, potentially leading to code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently provided.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. This may allow attackers to execute arbitrary code or access sensitive files. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.