The vulnerability is an improper control of filename in PHP include/require statements, identified as a Local File Inclusion flaw (CWE‑98). An attacker could supply a crafted path that results in the theme including an arbitrary local file from the server. This can lead to disclosure of sensitive data, or if the included file contains code, potentially remote code execution. The vulnerability exists through DiveIt version 1.4.3 inclusive.

WordPress sites that use the AncoraThemes DiveIt theme. The vulnerability affects all releases of the theme from its initial version up through and including 1.4.3.

The CVSS score of 8.1 signals a high severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation currently. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request that supplies a path parameter to a form, script or admin option that is directly passed to an include or require call. No special privileges or authentication appear to be required, meaning the compromise could be carried out by anyone who can access the affected website.