This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the ThemeREX Gridiron theme. It allows an attacker to perform Local File Inclusion (LFI), potentially enabling arbitrary code execution or disclosure of sensitive files. The affected versions include all releases up to and including 1.0.14. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files to execute arbitrary code or disclose sensitive information. The vulnerability affects all installations of ThemeREX Gridiron up to version 1.0.14. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints. Monitor vendor channels for updates and apply patches promptly once available.