The vulnerability stems from an improper control of the filename used in PHP Include/Require statements within the Pearson Specter WordPress theme, classified as CWE‑98. This flaw enables a local file inclusion attack, allowing an attacker to read or execute arbitrary files on the server if they can influence the include path. The impact may range from disclosure of sensitive configuration files to execution of malicious PHP code, potentially leading to full site compromise if the attacker can also inject further attack payloads.

AncoraThemes Pearson Specter, the WordPress theme, for all released versions up to and including 1.11.3. The issue is stated to affect the theme from the earliest available release (n/a) through 1.11.3.

The flaw is assigned a CVSS score of 8.1, indicating high severity. The EPSS score is below 1 %, meaning current exploitation activity in the wild is expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. In practice, an attacker would need to supply crafted input parameters or URLs that the theme processes for inclusion; the lack of directory restrictions on include paths makes the local file inclusion vector straightforward once such input is reachable.