Technical impact
The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP. AncoraThemes Saveo theme allows a local file inclusion, meaning an attacker could supply a crafted filename that causes the server to include an arbitrary local file. If the attacker can inject PHP code, this could lead to disclosure of sensitive files, modification of server files or remote code execution, impacting confidentiality, integrity and potentially availability of the WordPress site.
Affected Systems
AncoraThemes "Saveo" theme for WordPress is impacted. Versions from n/a through 1.1.2 contain the flaw; no other versions are listed as affected.
Risk and Exploitability
The CVSS score is 8.1, indicating a high severity. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker would need to craft a request to the theme that passes a filename, but depending on how the theme exposes the parameter, the LFI could be triggered via a web request. Successful exploitation would require sufficient input control or server permissions, and could provide arbitrary code execution.
