The CVE reports an improper control of filename for include/require statements in the Otaku WordPress theme. This flaw allows an attacker to manipulate the file path used by PHP to load content, enabling Local File Inclusion. By providing a specially crafted request, a malicious actor can read arbitrary files on the server, potentially leading to disclosure of sensitive data or execution of attacker‑supplied PHP code. The weakness corresponds to CWE‑98.

AncoraThemes’ Otaku theme is impacted in all releases up to and including version 1.8.0. Users running any of these versions on a WordPress installation are susceptible, regardless of the WordPress core version.

With a CVSS score of 8.1, the vulnerability is considered high. Its EPSS score is below 1 % and it is not listed in the CISA KEV catalog, indicating a relatively low probability of active exploitation at this time. The attack path involves submitting an unvalidated file path to the theme’s include logic, though the exact mechanism (e.g., via a URL parameter) is not explicitly stated in the source data. If successful, an attacker could read or execute local files on the affected host.