This vulnerability in Solene Core (<= 2.3.2) is an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames used in PHP include/require statements (CWE-98). It enables remote attackers to include arbitrary local files, which can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, indicating high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No official patch or remediation guidance has been published by the vendor as of the data provided.

Successful exploitation allows unauthenticated attackers to include and execute arbitrary local files on the affected system, potentially leading to full system compromise including disclosure of sensitive data, modification of files, and denial of service. The high CVSS score reflects the critical nature of this vulnerability impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and consider disabling or restricting PHP include/require functionality if possible. Monitor for updates from Elated-Themes regarding patches or official mitigations.