This vulnerability in AncoraThemes Honor arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. It affects versions up to and including 2.3. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are available, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to include local files on the server, potentially leading to arbitrary code execution, disclosure of sensitive information, and disruption of service. The high CVSS score reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes.