This vulnerability arises from improper validation of filenames used in PHP include/require statements within the AncoraThemes Festy theme. The flaw allows an attacker to specify an arbitrary local file path, causing the server to read or execute that file. As a result, sensitive configuration files, credentials, or other protected content may be exposed, and in more advanced scenarios, arbitrary PHP code could be executed, leading to full site compromise.

The affected product is the AncoraThemes Festy WordPress theme. All releases from the initial release up through version 1.13.0 are impacted. Any site using this theme within that version range is vulnerable.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not currently in the CISA KEV catalog. Based on the description, the likely attack vector is through a web request transmitted over the network, with an attacker supplying a crafted file path to the include/require functionality. Successful exploitation requires the attacker to identify a PHP endpoint that processes user input for file inclusion.