This vulnerability in AncoraThemes Lighthouse (<= 1.2.12) is an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filename input in PHP include/require statements (CWE-98). An attacker can exploit this to include arbitrary local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files without authentication, severely impacting the security posture of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor AncoraThemes communications for updates and apply patches promptly once available.