This vulnerability in AncoraThemes Tourimo arises from improper validation or control of filenames used in PHP include or require statements. It allows an attacker to perform Local File Inclusion (LFI), potentially enabling them to execute arbitrary code or access sensitive files on the server. The issue affects Tourimo versions up to 1.2.3. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected Tourimo installations. The attacker can leverage the LFI to include local files, which may result in full system compromise depending on the server configuration and file permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with LFI detection rules, and limiting file system permissions to reduce potential impact.