The vulnerability is caused by an improper control of filenames used in PHP include/require statements within the AncoraThemes Sanger theme. This flaw allows an attacker to supply arbitrary local file paths, leading to a Local File Inclusion (LFI) condition that can expose sensitive system files or, in some scenarios, enable further exploitation such as code execution. The weakness is classified as CWE‑98 – Improper Control of Filename for Include/Require Statement.

WordPress installations that use the AncoraThemes Sanger theme version 1.24.0 or earlier. The issue does not affect later major releases that surpass the 1.24.0 threshold.

With a CVSS score of 8.1 this vulnerability is considered high severity, yet the EPSS score indicates that the likelihood of public exploitation is currently low (<1%). The vulnerability is not listed in CISA's KEV catalog, meaning no widespread, actively exploited incidents have been reported at the time of analysis. Attackers would need to deliver a specially crafted request to the site that includes a malicious file path, exploiting the theme's lack of proper input validation. Successful exploitation could allow reading of local files and, depending on the server configuration, could potentially lead to execution of arbitrary PHP code.