The vulnerability CVE-2025-60044 affects AncoraThemes Fribbo versions up to 1.1.0 and is caused by improper control of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, allowing an attacker to include and execute local files on the server. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion on the server running AncoraThemes Fribbo, potentially allowing attackers to read sensitive files, execute arbitrary code, and fully compromise the affected system's confidentiality, integrity, and availability. Given the high CVSS score and the nature of the vulnerability, the impact is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected application and limiting exposure to untrusted users to reduce risk.