The vulnerability arises from improper control of file names used in PHP include/require statements within the UniTravel theme. This allows an attacker to supply crafted input that causes the theme to include local files via PHP's include mechanism. Local file inclusion can lead to reading sensitive files, executing arbitrary code, or escalating privileges, effectively compromising data confidentiality and integrity on the affected site.

Affected are WordPress sites using the AncoraThemes UniTravel theme versions 1.4.2 and earlier. The issue remains until a newer release that removes the insecure include logic.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Likely attack path involves an attacker submitting a malicious request that triggers the theme's insecure file inclusion. If successful, the attacker can read local files or run PHP code, leading to full site compromise.