The vulnerability CVE-2025-58895 affects AncoraThemes Integro up to version 1.8.0 and is caused by improper control of filenames used in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, which can allow attackers to execute arbitrary local files on the affected system. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a network attack vector with high impact on confidentiality, integrity, and availability but requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service due to arbitrary local file inclusion. The high CVSS score reflects the potential for significant impact on affected systems. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to vulnerable systems and consider temporary mitigations such as disabling vulnerable functionality or applying web application firewall rules to block malicious requests targeting include/require parameters.