This vulnerability in AncoraThemes Emberlyn arises from improper validation or control of filenames used in PHP include or require statements. It enables PHP Local File Inclusion (LFI), which can allow attackers to read sensitive files or execute arbitrary code depending on the environment. The issue affects versions up to and including 1.3.1. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to local file inclusion on the affected server, potentially exposing sensitive information, enabling code execution, or causing denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to vulnerable versions, applying web application firewall rules to detect and block suspicious include/require requests, and monitoring for unusual activity related to file inclusion attempts.