The AncoraThemes ChildHope theme versions up to 1.1.8 suffer from improper control of filenames in PHP include/require statements, resulting in a Local File Inclusion vulnerability. This vulnerability allows attackers to include local files on the server, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the server hosting the ChildHope theme. This can lead to full compromise of the affected system, including disclosure of sensitive information, code execution, and denial of service. The high CVSS score reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected ChildHope theme versions or applying manual code review and hardening to restrict file inclusion paths. Monitor official AncoraThemes communications for updates.