This vulnerability (CVE-2026-28152) affects Select-Themes Tonda Core before version 2.6. It is an unauthenticated local file inclusion (LFI) issue caused by improper control of filenames in PHP include/require statements (CWE-98). The flaw allows an attacker to include arbitrary local files, potentially leading to remote code execution and full system compromise. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system, including remote code execution and unauthorized access to sensitive data. The vulnerability is exploitable remotely without authentication, but requires high attack complexity. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is published, users should monitor Select-Themes advisories for updates. Until a patch is available, restricting access to the vulnerable application and disabling potentially exploitable functionality may reduce risk.