The vulnerability is an improper control over the filename used in an include/require statement within the Dentalux theme. This flaw allows an attacker to supply a crafted file path, leading to PHP local file inclusion. Such inclusion can expose sensitive files, reveal configuration details, or enable the execution of attacker-supplied code, thereby compromising the confidentiality and integrity of the WordPress site and potentially causing denial of service. The weakness corresponds to CWE‑98 and is rated as high severity by CVSS.

The vulnerable component is the AncoraThemes Dentalux WordPress theme, version 3.3 and all earlier releases. Any WordPress installation that contains this theme is affected. No other products are listed as impacted in the available data.

The CVSS score of 8.1 indicates a high risk level, while the EPSS score below 1% suggests that the vulnerability is not frequently exploited in the wild. The vulnerability is not included in the CISA KEV catalog, meaning it has not been confirmed as a widely exploited threat. Exploitation requires an attacker to trigger the include/require with a user-controlled path, usually via a crafted URL or form input that the theme processes. The attack vector is therefore inferred to be remote, relying on the website’s exposure to the open Internet.