The vulnerability is caused by uncontrolled filename handling in a PHP include/require statement within the AncoraThemes Tornados theme. The flaw (CWE‑98) permits an attacker to supply a custom path that the server will resolve and include, enabling the attacker to read any file the web‑server process can access. If the supplied file contains executable PHP code, the attacker could achieve remote code execution on the site.

WordPress installations that use the AncoraThemes Tornados theme, including all releases up to and including 2.1. Sites running older or newer versions are not affected by the enumerated LFI issue.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1 % suggests the risk of exploitation in the wild is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, via crafted HTTP requests that trigger the vulnerable include path. Successful exploitation would grant an attacker access to sensitive server files or the ability to execute arbitrary PHP code, potentially compromising the integrity of the entire WordPress installation.