The AncoraThemes Chronicle WordPress theme versions up to 1.0 contain a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control enables a Local File Inclusion (LFI) vulnerability, allowing attackers to include local files on the server. The vulnerability has a CVSS v3.1 score of 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction for exploitation.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, code execution, and full compromise of the affected web server hosting the vulnerable theme. The attacker can potentially read arbitrary files and execute malicious code, severely impacting the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme to prevent exploitation. Monitor official AncoraThemes channels for updates and apply patches promptly once released.