The flaw allows an attacker to influence the filename used in an include/require statement within the Shaha theme’s PHP code. By controlling that value the attacker can read any file that the web server can access, such as configuration or credential files, and if the chosen file contains PHP code the attacker could run it on the server. The vulnerability is classified as CWE‑98.

All WordPress sites that have the AncoraThemes Shaha theme installed with a version number up to and including 1.1.2 are affected. Any WordPress installation that enables this theme is vulnerable; the core WordPress version is not relevant to the scope.

The issue carries a high baseline severity and its EPSS score of < 1 % indicates a very low probability of exploitation, despite the vulnerability’s status outside the CISA KEV catalog. However, an attacker could trigger the local file inclusion by sending a crafted request to a publicly exposed URL that processes input forwarded to the vulnerable include/require call. Successful exploitation could allow the attacker to read critical system files or execute code, compromising confidentiality, integrity and availability.