AncoraThemes Takeout versions up to 1.3.0 suffer from improper control of the filename parameter in PHP include/require statements, leading to a Local File Inclusion vulnerability. This can allow an attacker to include unintended local files, potentially resulting in code execution or information disclosure. The vulnerability is remotely exploitable over the network without privileges or user interaction but requires high attack complexity. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary code or disclose sensitive information by including local files on the server running AncoraThemes Takeout. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the vulnerable application and carefully validate or sanitize any user-supplied input that controls file inclusion. Monitor vendor communications for updates.