Technical impact
This vulnerability resides in the AncoraThemes Tooth Fairy WordPress theme, where an improper control of the filename used in an include/require statement allows a local file to be included by a PHP script. Because the theme accepts arbitrary file names from user input, an attacker could read sensitive files on the server or trigger PHP code execution if a remote file is specified and the server allows such includes. The vulnerability type corresponds to CWE-98 and carries a CVSS score of 8.1, indicating high severity.
Affected Systems
All installations of the Tooth Fairy theme from the earliest available version up to and including 1.16 are affected. The product is distributed by AncoraThemes and is typically installed in the /wp-content/themes/tooth-fairy directory of a WordPress site.
Risk and Exploitability
The attack vector is inferred to be local to the web application, as the attacker needs to influence an HTTP request that triggers the vulnerable include. The EPSS score of less than 1% suggests that exploitation is currently rare but still present. The vulnerability is not listed in the CISA KEV catalog, indicating no known mass exploitation at this time. However, the high CVSS score and the simple input manipulation required mean that determined attackers could feasibly achieve code execution or data disclosure on susceptible systems.
