The vulnerability permits local file inclusion through an unchecked filename in a PHP include/require statement within the Your Dress theme. This allows an attacker to load arbitrary files from the server, potentially exposing sensitive data and, if suitable payloads can be included, enabling remote code execution. The weakness identified as CWE‑98 shows improper input sanitization for include paths.

AncoraThemes Your Dress theme version 1.4.1 or earlier on WordPress sites is affected. All releases from the initial version through 1.4.1 contain the flaw; newer releases have addressed the issue.

The CVSS score of 8.1 indicates high risk. The EPSS score is not available, so the likelihood of exploitation remains uncertain, though the flaw can be triggered via a crafted request to the theme, likely requiring unauthenticated access. The vulnerability is not listed in the CISA KEV catalog, suggesting it may not have widespread known exploitation yet. Nevertheless, the ability to include local files poses a serious threat if the attacker can control the include path, so mitigation is recommended promptly.