This vulnerability in AncoraThemes Ironfit arises from improper validation or control of filenames in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to execute arbitrary code or access sensitive files on the server by including local files. The issue affects Ironfit versions up to and including 1.5. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability with high severity. No known exploits are reported in the wild, but the potential impact is significant given the nature of local file inclusion vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider disabling or restricting vulnerable functionality, applying web application firewalls to detect and block suspicious requests, and reviewing server file permissions to limit exposure. Monitor AncoraThemes communications for updates or patches addressing this vulnerability.