The AncoraThemes Mamita WordPress theme versions 1.0.9 and earlier contain an improper control of filename for include/require statements, classified as CWE‑98. This flaw permits the inclusion of arbitrary local files through the PHP include mechanism, potentially allowing an attacker to read sensitive server files such as configuration, logs or credentials. If an attacker can manipulate the included file to execute a PHP payload, the vulnerability could be leveraged for remote code execution.

Any WordPress site deploying the AncoraThemes Mamita theme prior to version 1.1.0 is affected. The vulnerability applies to all releases through 1.0.9 and earlier, as indicated by the vendor’s scope.

The CVSS score of 8.1 categorizes the flaw as high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV. Based on the description, the likely attack vector is a web‑based request that supplies a manipulated file path to trigger the include/require statement. The exploit requires access to the WordPress site’s publicly exposed endpoints that invoke the vulnerable theme code; no authentication is stated, so an unauthenticated user may be able to exploit it.