Technical impact
The vulnerability is an improper control of the filename used in PHP include/require statements in the Green Planet theme. An attacker can trigger a local file inclusion, allowing arbitrary files on the server to be read. This could reveal configuration files, credentials or other sensitive data and potentially enable further attacks depending on the files accessed.
Affected Systems
AncoraThemes Green Planet theme versions 1.1.14 and earlier are affected; the issue applies to all deployments of the theme through release 1.1.14.
Risk and Exploitability
The CVSS score is 8.1, indicating high severity, but the EPSS score is below 1%, showing a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or web‑based, requiring an input that can influence the include path, such as through a plugin or user‑submitted data. Attackers can read files that the webserver user has access to, potentially compromising sensitive information.
