This vulnerability in AncoraThemes Yolox arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all releases up to and including 1.0.15. The issue allows an attacker to include local files on the server, which can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to full compromise of the affected system by allowing an attacker to execute arbitrary code or access sensitive files. The vulnerability impacts confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying general PHP security best practices relevant to file inclusion vulnerabilities.