The vulnerability CVE-2025-52768 in AncoraThemes Faith & Hope arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows local file inclusion (LFI), where an attacker can manipulate the filename parameter to include arbitrary files from the server. The affected versions are up to and including 2.13.0. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the critical impact potential. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes. No vendor advisory or patch links are currently provided.