Technical impact
The CVE arises from an improper control of filenames that are passed directly to PHP’s include/require statements within the AncoraThemes Zio Alberto theme. Because the theme accepts arbitrary file paths, an attacker can cause the web server to read and execute files located anywhere on the filesystem. This can lead to the disclosure of configuration files, credentials, or other sensitive data, and, if the included file contains malicious code, can result in full control over the site. The weakness is identified as CWE‑98.
Affected Systems
All installations of the Zio Alberto theme with a version number up to and including 1.2.2 are affected. The description specifies the vulnerability exists from "n/a through <= 1.2.2", implying that any deployment using a version within that range must be considered vulnerable.
Risk and Exploitability
The CVSS base score of 8.1 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that, at the time of this analysis, exploitation is unlikely to be widespread. The likely attack vector is inferred from the description: an attacker can supply a crafted request that passes an arbitrary file path to the insecure include logic, possibly through a visible query parameter or a hidden form field. Although the vulnerability has not been listed in the CISA KEV catalog, the potential for confidential data disclosure or code execution warrants immediate attention.
