Technical impact
The vulnerability exists in the AncoraThemes FixTeam WordPress theme and allows an attacker to manipulate the filename used in a PHP include or require statement. By providing a crafted path, the site can include local files, potentially exposing sensitive configuration files or executing arbitrary PHP code, which can compromise confidentiality, integrity, and availability of the affected WordPress installation if leveraged.
Affected Systems
WordPress sites that have installed AncoraThemes FixTeam version 1.5.0 or earlier are affected. The issue is present from the earliest available release up through version 1.5.0.
Risk and Exploitability
The CVSS score of 8.1 indicates high severity. While the EPSS score is below 1%, suggesting low current exploitation probability, the vulnerability is not in the KEV catalog. The attack likely requires the ability to supply a crafted request that reaches the vulnerable include statement, which may be possible without authentication if the theme does not restrict access. Once exploited, the attacker could read sensitive files or execute arbitrary code, potentially taking control of the site.
