The vulnerability arises from improper handling of filenames in PHP include/require statements in the AncoraThemes Militarology WordPress theme, enabling local file inclusion. Attackers could trigger PHP to include arbitrary local files, potentially exposing sensitive data or executing malicious code. The flaw is classified as CWE‑98 and carries a CVSS score of 8.1, indicating a high severity.

AncoraThemes Militarology theme installations running version 1.0.15 or earlier are affected. No other vendors or products are listed. Upgrading beyond 1.0.15 removes the weakness.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is unlikely but still possible. Attackers would need to send a crafted request that passes an unchecked filename to an include/require in the theme; the exploit does not require elevated privileges on the operating system. Because the flaw allows local file inclusion, the impact could include reading sensitive files or remote code execution if the included file is crafted appropriately. Administrators should therefore treat the issue as high risk.