The vulnerability involves improper control of the filename used in PHP include/require statements within the Playful theme. An attacker who can influence the filename can cause the theme to read arbitrary local files, potentially exposing sensitive configuration files or, if the included file contains executable code, leading to local code execution. The primary impact is local file inclusion, which can compromise confidentiality and integrity of the site.

AncoraThemes’ Playful WordPress theme is impacted. All installations of the theme version 1.19.0 or earlier are vulnerable. Any WordPress site running this theme within the stated version range is at risk.

The CVSS score of 8.1 signals high severity. The EPSS score of less than 1% suggests that exploitation likelihood is currently low, and the vulnerability is not in the CISA KEV catalog. Attacks require an attacker to supply a crafted request that triggers the vulnerable include logic. While there is no known public exploit at this time, the vulnerability could read arbitrary files and, based on the description, it is inferred that the flaw might allow code execution if an attacker can include a file containing PHP code. The risk remains theoretical until a proof‑of‑concept materializes.