This vulnerability in AncoraThemes PartyMaker arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The issue affects PartyMaker versions up to and including 1.1.15. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

Successful exploitation of this vulnerability can result in an attacker including local files on the server, which may lead to remote code execution, data disclosure, and full system compromise. The high CVSS score (8.1) reflects the critical impact on confidentiality, integrity, and availability. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting access to vulnerable installations and applying general PHP hardening measures relevant to file inclusion vulnerabilities.