This vulnerability in AncoraThemes Horizon arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include Horizon up to and including 1.1. The vulnerability allows an unauthenticated attacker to include local files, which can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can result in the inclusion of arbitrary local files on the server, potentially leading to remote code execution, data disclosure, or service disruption. The high CVSS score reflects the critical nature of these impacts. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible or applying other protective controls such as web application firewalls to detect and block malicious requests targeting file inclusion.