This vulnerability permits an attacker to supply an arbitrary filename to PHP include or require statements within the Isida theme, enabling Local File Inclusion. Such inclusion can allow the attacker to read sensitive files or, if the attacker can upload PHP code, execute arbitrary code on the server. The impact is therefore a possible compromise of confidentiality, integrity, and availability of the affected WordPress site.

AncoraThemes Isida theme versions up to and including 1.4.2 on WordPress installations are affected. All installations that use the default Isida theme logic without a later revision are vulnerable.

The CVSS score of 8.1 indicates high technical severity. The EPSS score of less than 1 % suggests that, at present, the likelihood of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the likely attack vector is a web‑based request that manipulates a filename parameter to trigger the vulnerable include path. Should an attacker successfully exploit this flaw, they could read arbitrary files or execute code, potentially leading to full server compromise.