An improper control of filename for include/require statements in the AncoraThemes Gustavo WordPress theme permits local file inclusion. This weakness is categorized as CWE‑98. The vulnerability can allow an authenticated or unauthenticated attacker to read arbitrary local files or execute arbitrary PHP code, effectively compromising the confidentiality, integrity, and availability of the affected WordPress installation.

The Gustavo theme distributed by AncoraThemes is affected only in versions up to and including 1.2.2. Sites that have installed any of these versions expose the filesystem to local file inclusion. The vulnerability applies to any WordPress environment that supports this theme.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability does not appear in the CISA KEV catalog. The attack vector is inferred to be local file inclusion through manipulated input that the theme uses in its include/require logic; an attacker could supply a crafted path via a URL parameter or form field to trigger inclusion of sensitive system files or execute malicious PHP scripts.