This vulnerability in AncoraThemes Grit arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. The affected versions include all versions up to and including 1.0.1. The vulnerability allows an attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available from the vendor or other sources.

Successful exploitation can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive files, or disrupt service. The CVSS vector indicates network attack vector with high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from AncoraThemes. No vendor advisory or patch links are currently provided.