This vulnerability arises from an improper validation of filenames passed to a PHP include/require call, classified as CWE‑98. It enables a Local File Inclusion (LFI) attack, allowing an adversary to read files from the server and, if the included file contains executable PHP code, potentially run arbitrary commands on the host. The risk is that confidential configuration files, password files, or other sensitive data could be exposed, and execution of malicious code could lead to full system compromise.

WordPress sites that use the AncoraThemes Ludos Paradise theme version 2.1.3 or earlier are affected. Any WordPress installation that has this theme active is vulnerable.

The CVSS v3 score of 8.1 indicates a high severity potential, although the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting low current exploitation probability. Nonetheless, if an attacker controls URL parameters that are fed to the theme's include logic, they can trigger the LFI. The lack of a publicly available exploit does not mitigate the fact that the flaw can be exercised with a crafted request, making it a high‑risk issue for exposed sites.