This vulnerability in AncoraThemes Ludos Paradise arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all releases up to and including 2.1.3. The issue allows an attacker to potentially execute arbitrary code or access sensitive files by manipulating the filename parameter. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized local file inclusion, which may result in disclosure of sensitive information, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is significant if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting vulnerable functionality, applying web application firewalls to detect and block suspicious requests, and limiting access to the affected application. Monitor vendor channels for updates and patches.