Improper control over filenames used in PHP include/require statements within the AncoraThemes Felizia WordPress theme permits an attacker to specify arbitrary file paths. This local file inclusion flaw can expose sensitive configuration files or other content and, if a PHP file is included, may lead to the execution of malicious code on the server, compromising confidentiality, integrity, or availability. The weakness is classified as CWE‑98.

The vulnerability affects any WordPress installation that has the AncoraThemes Felizia theme version 1.3.4 or earlier. It is not tied to specific WordPress core releases, and all theme releases from the earliest version up to and including 1.3.4 are susceptible. Updating to version 1.3.5 or newer removes the flaw.

With a CVSS score of 8.1, the flaw is considered high severity. The EPSS score of less than 1 % suggests a low likelihood of widespread exploitation in the general user population, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker controlling the filename passed to the theme’s include/require logic, enabling arbitrary file access. If the included file contains executable PHP code, this can result in remote code execution.