This vulnerability in AncoraThemes Etta arises from improper validation of filenames in PHP include or require statements, enabling PHP Local File Inclusion attacks. Affected versions include all up to 1.14.0. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to include and execute arbitrary local files on the server, potentially leading to remote code execution, data disclosure, and full system compromise. The high CVSS score indicates critical impacts on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from AncoraThemes. Monitor vendor channels for updates.