This vulnerability, identified as CWE-98, involves improper control of filenames in PHP include or require statements within Elated-Themes Malmö software. Specifically, versions up to 2.2 are affected by an unauthenticated Local File Inclusion flaw, which can be exploited remotely without authentication. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to remote inclusion of local files, allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The impact affects confidentiality, integrity, and availability at a high level. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable functionality if possible and monitor for updates from Elated-Themes. No official or temporary fixes are currently documented.