AncoraThemes Mr. Cobbler theme contains an improper control of the filename passed to a PHP include/require statement. This flaw permits a local file inclusion, letting an attacker read arbitrary files on the server and, if a PHP script is included, execute arbitrary code. The vulnerability is classified as CWE-98 and carries a high CVSS score of 8.1, underscoring its potential impact on confidentiality, integrity, and availability.

Every WordPress site that uses the Mr. Cobbler theme version 1.1.9 or earlier is affected. The issue applies to all releases from the initial release up to and including 1.1.9. Only AncoraThemes supplies the theme, but all sites deploying it regardless of hosting environment are vulnerable.

The vulnerability's CVSS base score of 8.1 indicates a serious risk. An EPSS score below 1 % suggests a low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is through a user-controlled request that supplies a file path to the theme; the CVE description infers that this can be triggered via an improperly validated parameter or template file. Exploitation would require access to such a request and the ability to influence the included path.