This vulnerability in Themewinter WP Cafe Pro versions before 3.0.15 allows an author-level user to exploit improper control of filenames used in PHP include or require statements, leading to local file inclusion (LFI). This can result in the disclosure of sensitive information or potentially allow code execution depending on the context. The CVSS vector indicates that exploitation requires network access, high attack complexity, and privileges of an author, with no user interaction needed. The impact includes high confidentiality, integrity, and availability consequences.

An attacker with author privileges can exploit this vulnerability to include local files on the server, potentially exposing sensitive data or enabling further attacks that compromise the confidentiality, integrity, and availability of the affected system. The attack complexity is high and requires author-level privileges, limiting the attack surface to authenticated users with those rights.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level privileges to trusted users only and monitor for suspicious activity related to file inclusion attempts.