The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, allowing local file inclusion within the AncoraThemes Impacto Patronus theme. An attacker can supply a crafted filename that the theme includes without validation, exposing sensitive files such as configuration files or password files. In the worst case, if the included file contains executable PHP code, the attacker could gain full control over the web application or the underlying server.

The issue affects the Impacto Patronus WordPress theme released by AncoraThemes, specifically versions up to and including 1.2.3. All installations of these versions are potentially vulnerable.

With a CVSS score of 8.1 the vulnerability is considered High severity. The EPSS score is reported as less than 1%, indicating current exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a web request that manipulates the filename parameter within the theme’s PHP code, which is executed in the context of the web application. Successful exploitation requires that the attacker can influence the input passed to the include/require statement, thereby leading to file disclosure or execution of attacker‑controlled code.