The Lymcoin WordPress theme version 1.3.12 and earlier contains an improper control of filenames in PHP include/require statements, allowing a crafted request to specify a path that is included by the theme. This flaw gives an attacker the ability to read or execute local files on the server, resulting in a local file inclusion vulnerability classified as CWE‑98. The potential impact includes disclosure of sensitive configuration or code, and if a PHP file is included, arbitrary code execution in the context of the web application.

The vulnerability affects the AncoraThemes Lymcoin WordPress theme. All releases from the initial version through and including 1.3.12 are impacted. No other vendors or products were reported as affected.

The CVSS score of 8.1 indicates high severity, while an EPSS score of <1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Based on its description, the likely attack vector is a local file inclusion triggered by an attacker who can control the include path within the theme, potentially through crafted URLs or form submissions. Successful exploitation can lead to reading sensitive files or executing arbitrary PHP, giving the attacker full compromise of the affected site.