This vulnerability (CVE-2026-65477) in Select-Themes Tonda Core (<= 2.1.2) is a local file inclusion issue caused by improper control of filenames in PHP include/require statements (CWE-98). It allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive files, resulting in high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.5, reflecting network attack vector with high impact but requiring high attack complexity and low privileges. No patch or official remediation level has been published as of now.

The vulnerability allows an attacker to include local files via manipulated input to PHP include/require statements, potentially leading to arbitrary code execution or disclosure of sensitive information. The impact is rated high for confidentiality, integrity, and availability, meaning successful exploitation could compromise system security significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable versions and monitor for suspicious activity related to file inclusion attempts. Avoid exposing vulnerable endpoints to untrusted users.