This vulnerability in ThemeREX Invetex arises from improper validation of filenames used in PHP include or require statements, leading to Local File Inclusion (LFI). LFI can allow an attacker to include files on the server, potentially exposing sensitive information or enabling code execution. The affected versions are up to and including 2.18. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to disclosure of sensitive files, unauthorized code execution, and disruption of service. The high CVSS score reflects the potential for severe impact on the affected system's confidentiality, integrity, and availability. No known exploits are reported, so active exploitation is not confirmed at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to vulnerable components and applying any recommended temporary mitigations from the vendor. Monitor official ThemeREX communications for updates on patches or workarounds.