An improper control of the filename used by the include/require statement in WordPress’s Anarkali theme enables an attacker to influence which local file is loaded by the PHP runtime. This flaw can lead to the disclosure of sensitive data or the execution of arbitrary code if a malicious file is read or executed. The weakness is a classic file inclusion problem, classified as CWE‑98, and jeopardizes the confidentiality, integrity, and availability of the affected system.

The affects the Ninetheme Anarkali WordPress theme through the 1.0.9 release. Any WordPress installation running this theme, or any prior unpatched version, is susceptible.

The CVSS score of 8.1 signals a high severity risk. The EPSS score of less than 1% signifies that, as of the last assessment, exploitation is unlikely, and the vulnerability is not catalogued in the CISA KEV database. The likely attack vector is local file inclusion via a flaw in the theme’s filename handling, which could be invoked with a crafted request that directs the include to a sensitive or malicious file. While the precise exploitation path requires further details, the high CVSS indicates that the vulnerability can have serious consequences if leveraged.