The Mounty theme contains a local file inclusion vulnerability caused by an unchecked filename parameter in a PHP include/require statement, allowing an attacker to read or execute files on the web server. An attacker who can supply a filename could read sensitive files such as configuration files or, if a malicious file can be placed on the server, execute arbitrary PHP code.

Any WordPress installation that uses The Mounty theme from the initial release up to and including version 1.1 is affected. AncoraThemes markets this theme under that vendor name, and all releases prior to 1.2 are considered vulnerable.

The flaw carries a CVSS score of 8.1, indicating high severity. EPSS is below 1%, so current public exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access or the ability to supply an arbitrary filename via the theme’s parameter; an attacker with write access could also upload a malicious file and trigger the inclusion.