AncoraThemes Hypnotherapy theme up to version 1.2.10 contains an improper control of filenames in PHP include/require statements. This flaw allows an attacker to specify paths that bypass the intended constraints, enabling the inclusion of local files. If the included file contains PHP code, the attacker can achieve remote code execution. The weakness aligns with CWE‑98.

WordPress sites using AncoraThemes Hypnotherapy theme versions from any version through 1.2.10 are affected. The issue persists on all installations that have not upgraded past version 1.2.10.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% suggests low likelihood of current exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing immediate risk exposure. The likely attack vector is local, requiring an attacker to trigger the vulnerable code path on the hosted WordPress instance, possibly through crafted requests or file uploads that invoke the flawed include logic.