This vulnerability in AncoraThemes Anderson affects versions up to 1.4.2 and involves improper control over the filename used in PHP include or require statements. This can lead to Local File Inclusion (LFI), where an attacker can cause the application to load and execute unintended files from the local filesystem. The vulnerability is remotely exploitable over the network without authentication, but requires high attack complexity. The impact includes high confidentiality, integrity, and availability loss. No vendor patch or advisory is currently available.

Successful exploitation allows an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality and applying strict input validation or web application firewall rules to mitigate exploitation risk.