The vulnerability in AncoraThemes Weedles arises from an improper control of the filename used in PHP include/require statements, leading to a Local File Inclusion flaw. This weakness falls under CWE‑98 and allows an attacker to read arbitrary files from the server’s filesystem, potentially exposing sensitive configuration or code. The misuse of filename control is the core issue, with no explicit mention of remote code execution capabilities in the official description.

All WordPress installations that use the AncoraThemes Weedles theme with versions from the initial release up through 1.1.12 are affected. Users with any later version are not impacted unless they have not applied the update that removes the vulnerable code path.

The CVSS score of 8.1 signals a high severity vulnerability, while an EPSS score of below 1 % indicates a low but existing probability of exploitation. The bug is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves manipulating user‑controlled input that determines the include path, thereby causing the theme to include unintended files. Successful exploitation would enable data disclosure through reading of arbitrary files on the server. This assessment is derived directly from the provided details and does not assume any additional capabilities beyond the Local File Inclusion described.