The vulnerability CVE-2025-58899 affects AncoraThemes Frame versions up to 2.4.0 and is caused by improper control of filenames in PHP include or require statements. This allows an attacker to perform PHP Local File Inclusion, potentially enabling arbitrary code execution or disclosure of sensitive files. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a network attack vector with high impact on confidentiality, integrity, and availability, but requiring high attack complexity and no privileges or user interaction.

Successful exploitation can lead to local file inclusion, which may allow attackers to read sensitive files or execute arbitrary code on the server, compromising confidentiality, integrity, and availability of the system. The high CVSS score reflects these severe impacts. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should monitor vendor communications for updates and consider restricting access to vulnerable components or applying temporary mitigations if recommended by the vendor.