The vulnerability in AncoraThemes Exit Game theme arises from improper handling of filenames used in PHP include/require statements. An attacker can manipulate parameters that control the file path, enabling the theme to read any file on the server or execute PHP code if the chosen file contains executable code. The flaw is a classic Local File Inclusion (CWE‑98) that can expose sensitive files or elevate privileges. The impact is high, with the potential for remote code execution, data leakage, and complete site compromise.

Designated vendor AncoraThemes provides the Exit Game theme, versions 1.4.3 and earlier are affected. Any installation of the theme from its initial release up through inclusive version 1.4.3 is vulnerable to the flaw.

The CVSS score of 8.1 reflects the severity of this vulnerability, and the EPSS score of less than 1 % indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would typically involve sending crafted HTTP requests that include a manipulated filename in a public page powered by the theme. The attacker needs only the theme to be active and the site to be publicly reachable; no additional access is required. Given the high impact and the exploitation path, immediate remediation is advised to mitigate potential compromise.