This vulnerability in AncoraThemes CloudMe arises from improper validation of filenames used in PHP include or require statements, leading to a PHP Local File Inclusion issue. This can allow attackers to include and execute local files on the server, potentially resulting in remote code execution or unauthorized data access. The affected versions are up to and including 1.2.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction for exploitation.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical nature of these impacts. However, there are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor AncoraThemes communications for updates. Until a fix is available, consider restricting access to vulnerable components and applying application-level controls to limit file inclusion risks.