The vulnerability is an improper control of filename for include/require in PHP code, classified under CWE‑98. It allows an attacker to include arbitrary files from the local filesystem, which can lead to the disclosure of sensitive data or the execution of malicious code if the included files are interpreted as PHP. The primary impact is that a user with sufficient access to trigger the vulnerable include may compromise the confidentiality, integrity, or availability of the site’s files.

This flaw affects the AncoraThemes Piqes WordPress theme in all revisions up to and including version 1.0.11. No later releases have been documented in the CVE data, so any installation of Piqes 1.0.11 or older is potentially vulnerable.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1 percent suggests a low probability of exploitation at this time, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. Inferred from the description, the likely attack vector is through a local request that supplies a path to the vulnerable include statement; an attacker usually needs at least authenticated access or the ability to manipulate a parameter that the theme processes. If exploitation succeeds, the attacker may read or execute code on the server.