This vulnerability, identified as CWE-98, arises from improper control of filenames used in PHP include or require statements within the Select-Themes Struktur product. It allows an attacker to perform PHP Local File Inclusion, potentially enabling unauthorized file access or code execution. The affected versions are all versions up to and including 2.5.1. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation could allow an attacker to include and execute local files on the server, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized data access, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application and applying any recommended configuration changes to limit file inclusion risks.