This vulnerability in AncoraThemes Fooddy versions up to 1.3.10 arises from improper validation or control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, where an attacker can cause the application to include unintended files from the local filesystem. The CVSS v3.1 score is 8.1, indicating high impact with network attack vector, high confidentiality, integrity, and availability impacts, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or disrupt service, severely impacting confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by AncoraThemes. Monitor vendor channels for updates.