The Gracioza WordPress theme contains an LFI vulnerability caused by improper validation of file names in include/require statements. An attacker can supply crafted input to the theme’s parameters, enabling the PHP interpreter to load arbitrary local files. If the attacker can trigger execution of PHP code through these files, it can result in privilege escalation, data exposure, or full site compromise. The weakness aligns with CWE‑98: Improper Control of Filename for Include/Require Statement.

All installations of AncoraThemes Gracioza theme versions up to and including 1.0.15 are affected. Any WordPress site using a vulnerable version of this theme is at risk.

The credit assigned by the CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, but it can be remotely exploited via an HTTP request that manipulates the theme’s input parameters. The overall risk is thus high severity with a currently low exploitation likelihood, making patching a priority.