Improper control of filenames in PHP include statements allows a local file inclusion (LFI) flaw. This can let an attacker read configuration files, view source code, or execute code if the attacker can supply a path to a writable file. The issue is a classic CWE‑98 weakness and can compromise the confidentiality and integrity of a site.

WordPress installations that use the AncoraThemes Palladio theme version 1.1.10 or earlier are affected by the vulnerability. No other products are listed as impacted.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is an attacker who can influence the path passed to the include routine, such as by uploading a malicious script, form input, or crafted URL. If successfully exploited, the attacker could read or execute files on the local filesystem.