Technical impact
The vulnerability in AncoraThemes The Flash theme allows an attacker to include arbitrary local files using an unvalidated filename parameter. This flaw can lead to disclosure of sensitive configuration files or, if a malicious PHP file can be placed in the path, execution of arbitrary code on the server. It is rated CVSS 8.1, indicating high severity for confidentiality, integrity, and availability.
Affected Systems
All WordPress sites that are running the Flash theme version 1.15 or earlier are affected. The theme is distributed as a plugin for WordPress, so any site that has not upgraded beyond the stated version carries this risk.
Risk and Exploitability
The CVSS score of 8.1 reflects a high risk, while the EPSS score of <1% indicates a currently low probability of exploitation, and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request that supplies a directory traversal string to the vulnerable filename parameter, allowing the attacker to read local files or inject code if they can place a malicious PHP file in the include path. A determined adversary could exploit this to compromise the server.
