The vulnerability arises from unsanitized file name parameters used in PHP include/require statements within the Tourimo theme. When an attacker can influence the file name, they can trigger local file inclusion, potentially reading arbitrary files or, in some cases, executing PHP code. This weakness is classified as CWE‑98 and can lead to information disclosure or privilege escalation, depending on the accessed files.

AncoraThemes Tourimo WordPress theme versions 1.2.3 and earlier are affected. Any WordPress site running these theme versions is vulnerable.

The CVSS score of 8.1 indicates high severity, while the EPSS score of <1% suggests a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Attackers would most likely exploit this through a crafted request that triggers the theme's include mechanism, possibly via an administrative or publicly accessible endpoint.