This vulnerability in AncoraThemes Playa arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. It affects Playa versions up to and including 1.3.9. The issue can allow attackers to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive data, or disrupt service availability. The high CVSS score reflects the serious nature of these impacts. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable functionality and apply general PHP security best practices to limit exposure.