This vulnerability in AncoraThemes Otaku versions up to 1.8.0 arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. An attacker could exploit this to execute arbitrary local files on the affected system. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to include and execute arbitrary local files on the server running AncoraThemes Otaku, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized data access, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewalls with rules to detect and block suspicious include/require patterns, and monitoring for unusual file access. Avoid exposing the vulnerable application to untrusted networks if possible.