The AncoraThemes Tooth Fairy plugin for WordPress versions up to 1.16 contains a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control can lead to PHP Local File Inclusion, allowing an attacker to include and execute files from the local filesystem. The vulnerability is remotely exploitable over the network without authentication but requires high attack complexity. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS vector. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to arbitrary code execution, disclosure of sensitive information, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Tooth Fairy plugin if possible or restrict access to the affected system to trusted users only. Monitor official AncoraThemes channels for updates or patches addressing this vulnerability.