This vulnerability in ThemeREX Bazinga arises from improper validation or control of filenames in PHP include or require statements, leading to PHP Local File Inclusion. An attacker could exploit this to include unintended files on the server, potentially executing arbitrary code or accessing sensitive information. The affected versions include all versions up to and including 1.1.9. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary code or access sensitive files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running ThemeREX Bazinga up to version 1.1.9. The high CVSS score reflects the critical nature of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and applying general PHP hardening measures relevant to file inclusion vulnerabilities. Monitor official ThemeREX channels for updates.