This vulnerability in AncoraThemes Wabi-Sabi arises from improper control of the filename parameter used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include and execute local files on the server, potentially compromising the system. The issue affects versions up to and including 1.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to local file inclusion, which may allow attackers to execute arbitrary code, access sensitive information, or disrupt service availability. The high CVSS score reflects the potential for significant compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes. No vendor advisory or patch links are currently provided.