This vulnerability in AncoraThemes Mr. Cobbler arises from improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to arbitrary code execution or disclosure of sensitive information. The affected versions include all versions up to and including 1.1.9. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is available from the vendor or other sources.

Successful exploitation can lead to local file inclusion, which may allow attackers to execute arbitrary code, access sensitive files, or disrupt service on the affected system. The high CVSS score reflects the potential for significant impact on confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality, applying web application firewalls to detect and block suspicious requests, and limiting exposure of the affected application to trusted networks only.