AivahThemes\" Anona theme for WordPress contains an improper limitation of the pathname to a restricted directory, allowing attackers to perform path traversal and download arbitrary files from the server. The flaw is a classic CWE‑22 condition, where user-controlled input is used to construct a file path without adequate validation or sanitization. When exploited, an attacker can read sensitive files on the web server, which compromises confidentiality and may facilitate further attacks.

The vulnerability impacts the Anona theme distributed by AivahThemes. All versions from the initial release up through 8.0 are affected; any installation of the theme on a WordPress site using these versions is at risk.

The CVSS score of 7.5 indicates a high severity threat, while the EPSS score of less than 1% suggests a low to moderate current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. Typically, the attack vector is conducted over the web by sending a crafted request to the theme’s file‑download functionality, implying remote exploitation from an unauthenticated attacker. No prerequisites beyond access to the affected WordPress site are stipulated, making the condition straightforward to meet for an attacker with network visibility to the target.