The vulnerability CVE-2026-28124 affects AncoraThemes Notarius through improper control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially exposing sensitive information or enabling further code execution. The issue impacts versions up to 1.9. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to unauthorized disclosure of sensitive files, modification of application behavior, or denial of service. Given the high CVSS score (8.1) and the nature of local file inclusion vulnerabilities, the impact on confidentiality, integrity, and availability is high. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor AncoraThemes communications for updates. Until a fix is released, restricting access to vulnerable components and applying web application firewall rules to detect and block suspicious include/require requests may help mitigate risk.