The flaw stems from insufficient validation of a filename that is passed to a PHP include() or require() call in the HealthHub theme. This weakness, classified as CWE‑98, allows an attacker to perform a Local File Inclusion, giving them the ability to read or potentially execute arbitrary files on the server and thereby compromising the confidentiality and integrity of the WordPress installation.

AncoraThemes HealthHub theme for WordPress, versions 1.3.0 or earlier. Any site that has installed these versions is affected.

The CVSS score of 8.1 signals high severity, but the EPSS score of < 1 % suggests a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalogue. The description does not specify an authentication requirement, so the flaw is likely exploitable from a remote web request that supplies an untrusted filename. This inference is based on the wording that the flaw allows a “Local File Inclusion”; it is not explicitly stated in the data that authentication is needed.