The vulnerability arises from an improper control of the filename used in PHP's include/require statements within the AncoraThemes Parkivia theme. An attacker can manipulate the path parameter to trigger a local file inclusion, potentially allowing the reading of arbitrary files from the server. The description does not explicitly confirm execution of injected PHP code, but it is inferred that if a writable directory is involved an attacker could upload code, which could then be executed.

All installations of the Parkivia WordPress theme running version 1.1.9 or earlier are affected, including every version from the earliest release up to and including 1.1.9.

The vulnerability receives a CVSS score of 8.1, indicating high severity, but the EPSS score is less than 1%, suggesting a low likelihood of exploitation today. The flaw relies on a manipulated path delivered via an HTTP request, making the attack vector web‑based and potentially exploitable by remote users. The lack of a KEV listing indicates no widely known exploits are currently tracked. The inference that an attacker could execute arbitrary code is based on the presence of a writable directory and not directly stated in the input.