An attacker can manipulate PHP include/require statements in the Horizon theme to load arbitrary files from the server. The vulnerability, classified as CWE‑98, permits reading any file accessible to the web server. If the included file contains executable code, that code may be executed. This inference is not directly stated in the description, as the official text does not mention authentication requirements, so it is not guaranteed that any visitor can trigger the inclusion without credentials.

The issue affects all deployed versions of the AncoraThemes Horizon WordPress theme up to and including 1.1. No specific lower bound was identified, meaning versions 1.0 through 1.1 are all vulnerable.

With a CVSS score of 8.1 the flaw is considered high severity, yet the EPSS score is below 1%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The inferred attack vector is remote, where a malicious user supplies a crafted parameter that causes the theme to include a local file, potentially exposing sensitive data or executing arbitrary code. Breaches could compromise confidentiality, integrity, and availability of the affected WordPress site.