The vulnerability is an improper control of the filename used in a PHP include or require statement, allowing an attacker to include arbitrary local files. This flaw can let an attacker read sensitive files, execute malicious PHP code, or gain elevated privileges on the affected WordPress site, thereby undermining confidentiality, integrity, and availability.

AncoraThemes Winger theme for WordPress, versions up to and including 1.0.16 are affected.

Security analysts rate the CVSS score as 8.1, indicating a high severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is inferred as manipulating an input that influences the file path used by the theme, such as a crafted URL or form data submitted from the web interface. If successful, the attacker could trigger the include of a local file, potentially leading to code execution on the server.