A flaw in the AncoraThemes Greenville WordPress theme lets an attacker dictate the filename used in a PHP include or require operation. The vulnerability, classified as a local file inclusion, can be exploited to read or execute arbitrary files residing on the web server. If an attacker supplies a crafted path, the theme may load sensitive configuration, database, or code files, potentially exposing credentials or allowing the execution of malicious code stored on the server.

WordPress installations that have installed the AncoraThemes Greenville theme version 1.3.2 or earlier are affected. The issue applies to every release from the original deployment up to and including 1.3.2.

The flaw carries a CVSS score of 8.1, indicating a high severity. An EPSS score of less than 1% suggests that widespread exploitation has not been observed yet, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to supply a crafted file path through the theme’s input mechanism, which can be accessed via a publicly exposed page or an administrative interface. The likely attack vector is manipulating the include parameter through an external request, though the CVE description does not explicitly state remote code execution; such an outcome is inferred from the nature of the LFI weakness.