The vulnerability arises from an improper control of filenames used in include/require statements within the AncoraThemes Malta WordPress theme. This flaw classifies as a Local File Inclusion (CWE‑98) and allows an attacker to cause the PHP interpreter to include arbitrary files from the server’s filesystem. If successful, the attacker could read sensitive configuration files, view source code, or potentially execute malicious code in the context of the web application, thereby compromising confidentiality, integrity, and availability of the site.

AncoraThemes Malta theme for WordPress, affecting all installations using versions from n/a through version 1.3.3.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% shows a very low exploitation probability at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve unauthenticated users supplying crafted query parameters that reference file paths. Because the issue is a local file inclusion, it can be leveraged by attackers with access to the website to retrieve or execute unintended files if preconditions like open directory listing or misconfigured include paths are present. Overall, the risk is moderate due to high severity but low exploitation probability; however, the potential impact warrants immediate attention.