This vulnerability in ThemeREX Craftis affects versions up to 1.2.8 and stems from improper validation or control of filenames used in PHP include or require statements. This can result in PHP Local File Inclusion, allowing an attacker to include unintended files on the server. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability with network attack vector but requiring high attack complexity. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation can lead to local file inclusion, potentially allowing attackers to read sensitive files, execute arbitrary code, or disrupt service, impacting confidentiality, integrity, and availability of the affected system. The high CVSS score reflects these severe impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying general PHP security best practices relevant to file inclusion vulnerabilities. Monitor vendor channels for updates.