The vulnerability arises from improper control of filenames in PHP include/require statements, allowing an attacker to supply a path that references arbitrary local files. If unmanaged, this can lead to the disclosure of sensitive information or even execution of malicious code if an attacker can inject and include malicious content. The weakness is classified as CWE-98, a common file inclusion flaw exposed in WordPress admin context.

The affected product is the AncoraThemes Ironfit WordPress theme, version 1.5 and earlier. Any site running those versions is susceptible until updated. No other versions or products are listed in the CNA data.

The CVSS score of 8.1 indicates high severity, and although the EPSS value is less than 1%, the risk remains significant due to the broad spread of this theme. The vulnerability is not currently listed in the CISA KEV catalog, but its low exploitation probability does not eliminate the possibility of targeted attacks or future automated attempts. Attackers likely would target sites where the theme is present, leveraging the flaw via unauthenticated web requests if the vulnerable code is exposed to user input.