This vulnerability in AncoraThemes ElectroServ versions up to 1.3.2 arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. An attacker can exploit this to include arbitrary local files on the server, which may lead to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

Successful exploitation can result in local file inclusion, potentially exposing sensitive files, executing arbitrary code, or causing denial of service. The impact affects confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes regarding patches or mitigations.