This vulnerability in AncoraThemes uReach arises from improper validation of filenames in PHP include/require statements, leading to PHP Local File Inclusion. Affected versions include all releases up to and including 1.3.3. Exploitation could allow an attacker to execute arbitrary local files, impacting system confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1 with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server. This can lead to full compromise of the system, including disclosure of sensitive information, modification of data, and denial of service. The high CVSS score reflects the potential for severe impact across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include/require requests, and limiting file permissions to reduce the impact of potential exploitation.