The vulnerability CVE-2025-58891 affects AncoraThemes Sanger versions up to 1.24.0 and is caused by improper control over the filename parameter used in PHP include or require statements. This flaw enables PHP Local File Inclusion, allowing an attacker to include local files on the server, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full compromise of confidentiality, integrity, and availability of the system running AncoraThemes Sanger. The CVSS score of 8.1 indicates a high impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls to detect and block suspicious include/require requests, and reviewing code to ensure proper validation of input controlling file inclusion. Monitor vendor channels for updates and official patches.