The vulnerability CVE-2025-69077 affects AncoraThemes Hobo up to version 1.0.10 and arises from improper validation or control of filenames used in PHP include or require statements. This can lead to PHP Local File Inclusion, where an attacker may cause the application to include unintended local files, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned by Patchstack but lacks vendor patch or advisory details.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, which may lead to arbitrary code execution, disclosure of sensitive information, and disruption of service. The high CVSS score reflects the potential for significant impact on the affected system's confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions of AncoraThemes Hobo and apply general PHP hardening practices such as disabling dangerous PHP functions and restricting file system permissions relevant to the web server. Monitor vendor channels for updates and patches.