Technical impact
The vulnerability resides in the way the Blabber theme handles include/require statements. An attacker can manipulate the filename parameter to point to arbitrary files on the server. This local file inclusion allows the attacker to read sensitive configuration files or, if the included file contains executable PHP code, to execute arbitrary commands. The weakness is identified as CWE‑98, reflecting an improper use of file inclusion functions.
Affected Systems
All installations of the AncoraThemes Blabber theme with versions 1.7.0 or earlier are affected. Users of any WordPress site running this theme should verify the installed version and plan an update if still on a vulnerable release.
Risk and Exploitability
The CVSS score of 8.1 categorizes the issue as high severity. EPSS indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nonetheless, the likely attack vector is a local file inclusion request, typically through crafted URL parameters or form input that the theme accepts. If an attacker can influence the filename, they can read server files or execute PHP code, potentially leading to full site compromise.
