The vulnerability in the AncoraThemes Takeout WordPress theme stems from an improper control of filenames used in PHP include/require statements, a flaw that aligns with CWE‑98. An attacker can manipulate a filename parameter to cause the server to read arbitrary local files. While this does not provide direct remote code execution, the exposed data—such as configuration files or credentials—can enable further attacks.

All installations of the Takeout theme up to and including version 1.3.0 are affected. Users whose WordPress sites run an unpatched Takeout theme may be vulnerable to this local file inclusion flaw.

The CVSS score of 8.1 classifies the flaw as high severity, but the EPSS score of less than 1% indicates a low overall likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is via crafted HTTP requests that supply a malicious filename to the vulnerable include/require endpoint, allowing unauthenticated users to read arbitrary server files.