The vulnerability CVE-2025-60056 affects AncoraThemes Winger up to version 1.0.16. It arises from improper control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive local files, potentially leading to system takeover or data leakage. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable functionality or applying manual code review and hardening to prevent local file inclusion. Monitor vendor channels for updates.