This vulnerability in AncoraThemes Veil affects versions up to 1.9 and involves improper control of the filename parameter in PHP include/require statements, leading to PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially resulting in full system compromise. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, and full system compromise. The high CVSS score reflects severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes. No vendor advisory or patch links are currently provided.