This vulnerability arises from improper control over the filename used in PHP include or require statements, allowing an attacker to manipulate the path and load arbitrary files. A successful exploitation could enable local file inclusion, passing sensitive data to the attacker, or could potentially trigger remote file inclusion if the server’s remote file inclusion setting is enabled. The impact includes potential disclosure of system files, credential compromise, or execution of malicious code, severely affecting confidentiality, integrity, and availability of the website.

The problem exists in the AncoraThemes EasyEat WordPress theme, affecting all releases up through version 1.9.0. No specific sub‑version details are supplied, so any installation of EasyEat 1.9.0 or earlier is susceptible.

The vulnerability carries a CVSS score of 9.8, indicating a critical security flaw. The EPSS score of less than 1% suggests that, so far, exploit attempts have been minimal or not widely observed, and the vulnerability is not listed in CISA’s KEV catalog. However, given the high severity and the nature of file inclusion weaknesses, the risk remains significant. The likely attack vector is through user-controlled parameters in the URL or form inputs that influence the include path; this inference is drawn from the description of filename control issues in PHP.