The DetailX theme contains an include/require statement that accepts user-supplied filenames without proper validation. This flaw permits an attacker to forcibly include arbitrary files from the local filesystem, potentially leading to disclosure of sensitive information or execution of arbitrary PHP code. The vulnerability is a classic example of CWE-98, and its impact is limited to the compromised WordPress instance, but it can allow full site compromise if successful.

AncoraThemes DetailX theme versions up to and including 1.10.0 are affected. WordPress sites employing any of these legacy theme releases are at risk.

The CVSS score of 8.1 places the vulnerability in the high‑severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the flaw can be exploited by an attacker with web‑access to the target site by crafting a malicious URL that triggers the vulnerable include logic, potentially enabling remote code execution.