This vulnerability (CVE-2026-39549) in Elated-Themes Aperitif (<= 1.5) is an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in PHP include/require statements (CWE-98). The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges or user interaction required. The vulnerability allows attackers to include local files on the server, which can lead to remote code execution or data disclosure. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing attackers to include arbitrary local files. This can result in disclosure of sensitive information, execution of malicious code, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying virtual patching via web application firewalls if possible.