This vulnerability in AncoraThemes Muji arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. The affected versions include all releases up to and including 1.2.0. Exploitation can result in high impact on confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 8.1 with network attack vector, high attack complexity, no privileges or user interaction required, and unchanged scope. No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality or applying custom mitigations such as input validation or web application firewall rules to block malicious requests targeting file inclusion.