The ThemeREX Gamezone product up to version 1.1.11 suffers from an improper control of filename in PHP include/require statements, resulting in a Local File Inclusion vulnerability. This allows an attacker to potentially include and execute arbitrary local files on the server, which can lead to full compromise of the affected system. The vulnerability is remotely exploitable over the network without user interaction but requires high attack complexity and no privileges. The CVSS vector indicates high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected server by including local files. This can lead to full system compromise, data disclosure, and service disruption. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability of the system.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. In the meantime, restricting access to the vulnerable application and limiting file inclusion paths via server configuration may reduce risk. Avoid exposing the affected versions to untrusted networks until a fix is released.