Technical impact
The Honor theme contains an improper control of the filename used in include or require statements, which enables a local file inclusion flaw. An attacker can supply a path that resolves to any local file and, if the target file contains PHP code, can execute it. This leads to potential disclosure of sensitive files and, more critically, arbitrary code execution on the host, compromising confidentiality, integrity, and availability of the website.
Affected Systems
All installations of AncoraThemes Honor theme from the earliest release through version 2.3 are affected.
Risk and Exploitability
The vulnerability carries a high severity rating. The estimated likelihood of exploitation is currently below 1%, indicating a low current probability of being exploited. It is not currently listed in the Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is network: by creating a crafted URL that triggers the local inclusion, an unauthenticated attacker can supply a PHP file and achieve remote code execution.
