The vulnerability involves improper validation or control of filenames in PHP include/require statements within the UnTheme OrganicFood product, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an attacker to include unintended files on the server, potentially exposing sensitive information or enabling further attacks. The issue affects versions up to 3.6.4. No CVSS score or detailed vendor remediation information is provided.

The impact of this vulnerability is the potential for an attacker to include local files on the server through the PHP application, which could lead to information disclosure or other unintended behaviors depending on the included files. No known exploits have been reported, and the exact impact depends on the server environment and application configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying general PHP security best practices related to file inclusion. Monitor vendor channels for updates.