The CVE describes an improper control of filename for include/require statements in PHP code within the AncoraThemes PartyMaker WordPress theme. This flaw allows the theme to perform local file inclusion, enabling an attacker to read arbitrary files on the server. Such access could expose configuration data, credentials, or other sensitive information; in some cases it could also lead to execution of malicious code if the attacker can inject or control a local script. The weakness is identified as CWE‑98.

The vulnerability affects the PartyMaker WordPress theme provided by AncoraThemes for all released versions up to and including 1.1.15. Earlier releases are also impacted, as the issue is not limited to a specific revision. No additional product details are provided, and the affected version range is n/a through <= 1.1.15.

The CVSS score of 8.1 indicates a high severity impact for potential attackers. However, the EPSS score is listed as < 1%, suggesting a very low current likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated web request to a page that includes a user‑supplied filename, allowing the attacker to supply a file path that resolves to an arbitrary local file. Successful exploitation would give the attacker read access to the filesystem and potentially a foothold for further attacks.