This vulnerability, classified as CWE-98, arises from improper control of filenames in include or require statements within the PHP-based Verdure Core product by Elated-Themes. It allows unauthenticated attackers to perform local file inclusion (LFI) on affected versions up to 1.2, enabling arbitrary file execution. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. No patch or official remediation level has been published as of the data provided.

Successful exploitation can lead to arbitrary code execution on the server, full compromise of the affected system, and complete loss of confidentiality, integrity, and availability of the application and potentially the host system. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable component to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.