This vulnerability in the AncoraThemes Chronicle WordPress theme arises from improper validation of filenames used in PHP include or require statements. Specifically, the theme allows local file inclusion due to insufficient control over the filename parameter, which can be exploited to execute arbitrary local files on the server. The affected versions include all versions up to and including 1.0. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the server. This compromises the confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is considered severe. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of the affected theme should monitor AncoraThemes' official channels for updates. As a temporary measure, disabling or removing the vulnerable theme until a fix is available can reduce exposure.