This vulnerability arises from improper validation of filenames in PHP include or require statements within AncoraThemes Monyxi up to version 1.1.8. It enables local file inclusion (LFI), which can be leveraged by attackers to include and execute arbitrary local files on the server. The CVSS 3.1 score of 8.1 reflects a high impact with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, and potentially compromise the affected system's confidentiality, integrity, and availability. The high CVSS score indicates a serious risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable versions and applying general PHP security best practices relevant to file inclusion vulnerabilities.