This vulnerability in AncoraThemes Midi (<= 1.14) arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. An attacker could exploit this to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. There is no indication of an official fix or patch currently available, and no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability can lead to local file inclusion on the server running AncoraThemes Midi, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 indicates high impact across confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality and monitor for updates from AncoraThemes. No vendor advisory or patch links are currently provided.