The vulnerability CVE-2025-60054 affects AncoraThemes OnLeash versions up to 1.5.2 and is caused by improper control of filenames used in PHP include or require statements. This can result in PHP Local File Inclusion, allowing an attacker to include and execute local files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details.

Successful exploitation of this vulnerability can lead to local file inclusion, potentially allowing attackers to execute arbitrary code, access sensitive information, or disrupt service on the affected system. The high CVSS score indicates critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable versions of AncoraThemes OnLeash and apply general PHP hardening practices relevant to file inclusion vulnerabilities. Monitor vendor channels for updates and patches.