The vulnerability is an improper control of the filename used in a PHP include/require statement, allowing an attacker to locate and load arbitrary files from the server. This can lead to disclosure of sensitive configuration files, credentials, or local code execution if a crafted file is loaded. The weakness is classified as CWE‑98 and is rated highly severe with a CVSS score of 8.1.

AncoraThemes Lettuce theme for WordPress, versions from the earliest available through 1.1.7 are affected. No other versions or vendors are listed, and the issue does not apply to any newer releases beyond 1.1.7.

The EPSS score is below 1%, indicating that the probability of exploitation in the wild is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through user-controlled input to a theme file that performs a file include or require. An attacker could craft a request that resolves to an arbitrary local file, reading or executing it if the theme logic allows execution of included code. Because the vulnerability exists in the theme code and affects WordPress themes loaded from the public repo, an attacker who can upload files or influence theme configuration is able to exploit the flaw. The high CVSS score reflects the potential for remote code execution or data disclosure if exploited.