The vulnerability in the AncoraThemes Jack Well WordPress theme allows an attacker to include arbitrary local files through improper handling of the filename in a PHP include/require statement. This flaw can enable execution of arbitrary PHP code on the host, potentially resulting in complete compromise of the affected site. The weakness falls under CWE‑98, which describes failures to properly control file names used in inclusion functions.

AncoraThemes Jack Well theme version 1.0.14 and earlier. The issue is documented for all releases from the earliest known through 1.0.14; no higher version is listed as affected.

The CVSS score of 8.1 categorises this flaw as High severity and indicates that it can be exploited from a remote location if the application trusts user input in the filename parameter. However, the EPSS score is below 1 %, suggesting only a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted request that triggers the vulnerable include, likely through the theme’s file selection interface or via a crafted URL that feeds a malicious file path into the include statement.