The CloudMe theme for WordPress contains an improper control over filenames used in PHP include/require statements. This allows attackers to craft requests that force the application to include arbitrary files from the server's filesystem, potentially exposing sensitive configuration files or executing attacker‑supplied code. Because the vulnerability targets server‑side code inclusion (CWE-98), a successful exploit could lead to full code execution on the host or unauthorized data disclosure.

The affected product is the AncoraThemes CloudMe WordPress theme. The issue exists in all releases from the first release through version 1.2.2. Any WordPress site that is still running CloudMe version 1.2.2 or earlier is at risk. No other vendors or product variants are listed.

The CVSS score of 8.1 indicates a high severity vulnerability, but the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest that widespread exploitation is currently unlikely. The attack vector would typically involve sending a specially crafted request that manipulates the include or require path, which may require the attacker to have some level of authenticated access or to trigger a feature with a public endpoint. Despite the low probability, the potential impact justifies proactive remediation.