This vulnerability arises from improper validation of filenames used in PHP include or require statements within AncoraThemes Quantum, allowing an attacker to perform Local File Inclusion (LFI). The affected versions include Quantum up to and including 1.0. Exploitation could lead to disclosure of sensitive files, code execution, or denial of service. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, impacting confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute arbitrary local files. This can result in sensitive data disclosure, unauthorized code execution, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable functionality and applying strict input validation or web application firewall rules to mitigate exploitation risks.