The vulnerability in AncoraThemes Anderson theme versions up to 1.4.2 arises from improper validation of filenames used in PHP include or require statements. This improper control can be exploited to perform PHP Local File Inclusion, allowing attackers to include and execute local files on the server. The CVSS 3.1 vector indicates the attack requires network access, has high attack complexity, no privileges or user interaction, and impacts confidentiality, integrity, and availability at a high level.

Successful exploitation can lead to arbitrary code execution or sensitive information disclosure on affected systems running the vulnerable Anderson theme. This compromises the confidentiality, integrity, and availability of the affected web server and potentially the broader network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or applying manual code review and hardening to prevent inclusion of untrusted files. Monitor official AncoraThemes channels for updates.