Technical impact
The Great Lotus WordPress theme contains an improper control of the filename used in PHP include/require statements, which allows a local file inclusion flaw. An attacker could supply an arbitrary file path that the theme then tries to include, potentially exposing sensitive files or executing code if the included file is PHP.
Affected Systems
AncoraThemes Great Lotus WordPress theme versions up to and including 1.3.1 are susceptible to this weakness.
Risk and Exploitability
The CVSS score of 8.1 categorizes this vulnerability as high severity, indicating significant impact if exploited. The EPSS score of less than 1% suggests that active exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. The provided description does not specify a requirement for authentication, implying that web access to the vulnerable theme area may be sufficient to trigger the flaw.
