This vulnerability arises from improper validation or control of filenames in PHP include or require statements within the ThemeREX Police Department theme. It allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary code execution or disclosure of sensitive files. The issue affects versions up to and including 2.17. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to arbitrary file inclusion on the server, potentially resulting in remote code execution, data disclosure, or denial of service. The high CVSS score reflects the critical impact on system confidentiality, integrity, and availability. However, no known exploits have been reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints. Monitor ThemeREX communications for updates and apply patches promptly once released.