The vulnerability is an improper control of the filename used in an include/require statement within PHP, classifying it as a Local File Inclusion flaw. An attacker who can influence the file path may dereference arbitrary server files, potentially revealing sensitive configuration or content, and in some cases could trigger execution of PHP code. The weakness is a CWE‑98 flaw in input handling for file operations.

WordPress sites that have installed AncoraThemes Fabrica theme versions up through 1.8.1 are affected. Upgrading beyond 1.8.1 removes the flaw; earlier or older, including any 1.8.1 or older build, remains vulnerable. The issue is present in the theme’s core files responsible for rendering content, which can be triggered via exposed or unvalidated request parameters.

The CVSS score of 8.1 indicates high severity while the EPSS score of less than 1% suggests low current exploitation probability, though this could rise if the vulnerability is actively leveraged online. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could manipulate the file path supplied through the website’s query string or form inputs, leading to local file disclosure or executable code injection, depending on the server context and permissions.