The vulnerability arises from improper control of the filename used in an include/require statement in the AncoraThemes Monyxi WordPress theme. An attacker who can influence this filename may cause the server to read or execute arbitrary files, leading to disclosure of sensitive data or remote code execution if the included file contains executable code. This weakness is identified as CWE‑98, focusing on unsafe file handling in PHP.

AncoraThemes’ Monyxi theme is affected from the earliest available version through and including version 1.1.8. Users running any Monyxi build within that range are at risk, regardless of specific prior version names.

The CVSS score of 8.1 indicates a high severity, but the EPSS score of less than 1% points to a low probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation depends on an attacker’s ability to supply a malicious filename or manipulate the include path, which is typically possible only if the theme accepts user-controllable parameters or if remote code upload is feasible. The likely attack vector is a local file inclusion, which could enable arbitrary file access or execution if combined with other weaknesses.