AncoraThemes UnlimHost provides a PHP include/require that accepts a filename parameter without proper validation. An attacker who can influence the filename can cause the theme to read a file from the local filesystem. If the included file contains PHP code or the attacker can write a file, it might be possible to execute arbitrary code, but this possibility is inferred from the LFI nature. The high CVSS score of 8.1 reflects the potential severity.

The vulnerability affects all installations of the WordPress UnlimHost theme up to and including version 1.2.3. Any site using this theme and not upgraded beyond that point is exposed; no other vendors or products are listed as affected.

The EPSS score is below 1%, suggesting a low probability of immediate exploitation, and the vulnerability is not in the CISA KEV catalog. However, the flaw requires only a specially crafted filename, making it relatively easy once an attacker gains ability to control input. The combination of a high impact score and simple exploitation conditions means the risk remains significant for determined attackers. Administrators should prioritize applying a patch over passive monitoring.