AncoraThemes Wabi‑Sabi up to version 1.2 contains an improper control of filename for an include/require statement, which can be abused to read local files or execute arbitrary PHP code. This flaw falls under CWE‑98 and enables an attacker to act with the privileges of the web server, potentially compromising full site integrity.

WordPress installations running the Wabi‑Sabi theme from the earliest release through version 1.2 are impacted. The vulnerability is present in all revisions of the theme up to and including 1.2; no later releases are mentioned as affected.

The CVSS score of 8.1 indicates a high severity with potential for complete compromise. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through a malicious request that manipulates the theme’s file inclusion logic, typically via a public endpoint or administrative interface. Exploitation requires the attacker to control the file path parameter or inject code into a writable location, after which the server may execute unintended scripts.