This vulnerability in AncoraThemes Parkivia arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all releases up to and including 1.1.9. The vulnerability allows an attacker to include local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to local file inclusion, potentially exposing sensitive files, executing arbitrary code, or causing denial of service on the affected system. The high CVSS score indicates severe consequences if exploited. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should monitor AncoraThemes communications for updates and consider applying temporary mitigations such as restricting file inclusion paths or disabling vulnerable functionality if feasible.