This vulnerability in Element Pack Pro (<= 9.0.6) arises from improper control of filenames in PHP include/require statements, enabling local file inclusion (LFI). LFI can allow attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor or assigner. The vulnerability is publicly disclosed but not yet mitigated.

Successful exploitation could lead to remote code execution, disclosure of sensitive information, and disruption of service due to the local file inclusion flaw. The high CVSS score reflects severe potential impacts on confidentiality, integrity, and availability of affected systems. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable versions and applying compensating controls such as disabling vulnerable plugins or restricting file inclusion capabilities in PHP configurations. Monitor vendor channels for updates.