Technical impact
The vulnerability is an improper control of filename in PHP include/require statements that allows attackers to trigger PHP Local File Inclusion (LFI). By supplying a crafted filename, an attacker can force the application to read and execute arbitrary files from the local filesystem, potentially leading to disclosure of sensitive data or execution of arbitrary code on the host.
Affected Systems
The issue affects the WordPress theme "Woopy" from AncoraThemes. All releases of Woopy up to and including version 1.2 are vulnerable. This includes any installation that has not yet been updated beyond that version.
Risk and Exploitability
The reported CVSS score is 8.1, indicating high severity. The EPSS score is reported as less than 1%, implying a low likelihood of exploitation at the time of the assessment. This vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the LFI via a web request that supplies a malicious filename to the theme’s PHP include logic, so the likely attack vector is remote through the application’s web interface. With successful exploitation, an attacker could read sensitive configuration files, retrieve backups, or execute arbitrary PHP code, compromising the confidentiality, integrity, and availability of the affected WordPress site.
