The vulnerability is an improper control of filename for include/require statements in PHP, allowing local file inclusion. This flaw can be leveraged by an attacker to include arbitrary files, potentially leading to execution of malicious code or disclosure of sensitive information. The weakness is classified as CWE-98.

AncoraThemes Frame theme from any version through 2.4.0. The issue affects WordPress sites that are running this theme version, regardless of the WordPress core version.

The CVSS score of 8.1 indicates a high severity condition for exploitation. The EPSS score of less than 1% shows a low probability of being actively targeted, but the threat is still present. Because the vulnerability is not listed in the CISA KEV catalog, it is not currently known to have widespread exploitation. Likely attack vectors involve a crafted HTTP request that manipulates the filename supplied to an include or require statement.