This vulnerability in ThemeREX Scientia arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion. The affected versions are from initial releases through 1.2.4. Exploitation could lead to execution of arbitrary local files, impacting confidentiality, integrity, and availability of the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on all security properties.

Successful exploitation can result in local file inclusion, potentially allowing attackers to execute arbitrary code or access sensitive files on the server. This compromises confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, restricting access to the affected application and limiting exposure to untrusted users may reduce risk.