The GlamChic WordPress theme has a flaw that lets an attacker provide an untrusted file path to a PHP include or require statement. This uncontrolled inclusion is classified as CWE-98 and can lead to local file inclusion, allowing the attacker to read arbitrary files on the server or execute malicious code. The likely attack vector is via a theme function that accepts a file path parameter without proper validation, as inferred from the description that the vulnerability is due to "Improper Control of Filename for Include/Require Statement."

AncoraThemes GlamChic theme versions from the initial release through version 1.0.11 are affected. Any WordPress site that deploys these versions is vulnerable, regardless of site configuration or other plugins. The problem is tied to the theme’s code and does not require specific server settings beyond the default WordPress installation.

The vulnerability has a CVSS score of 8.1, indicating high severity. Its EPSS score is less than 1%, suggesting that mass exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. Nevertheless, because the flaw allows attackers to supply a crafted file path via a theme function that is easy to discover and trigger, the potential impact remains significant for exposed sites that cannot apply the patch immediately.