This vulnerability in stmcan RT-Theme 18 | Extensions (rt18-extensions) arises from improper control of the filename parameter in PHP include/require statements, enabling PHP Local File Inclusion. The issue affects all versions up to and including 2.5. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable functionality and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates.