An improper file name validation in PHP include/require statements allows local file inclusion. An attacker could supply a crafted path and read arbitrary files on the web server, leaking credentials or other confidential data. The weakness is identified as CWE-98.

AncoraThemes Emberlyn theme, versions up through 1.3.1.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA KEV. It can be exploited by providing a malicious file path to the vulnerable include operation, likely requiring only a crafted URL or form input. No official solution is published yet, so applying a later version or mitigating input handling is recommended.