The Triompher theme for WordPress contains an improper control of filename for include/require statements in its PHP code, allowing a victim to supply a crafted request that causes the server to read local files. The flaw provides an attacker with the ability to view arbitrary contents of the server’s file system, which could expose sensitive data such as configuration files or credentials. No mention is made of code execution or other effects beyond file disclosure.

All installations using the AncoraThemes Triompher theme with versions up to and including 1.1.0 are affected. Any WordPress site employing this theme—regardless of other plugins or core versions—faces the potential threat.

The CVSS score of 8.1 classifies the issue as high severity, yet the EPSS score is noted as below 1%. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a local file inclusion that requires an attacker to send a crafted request to the site; this inference is based on the nature of the flaw and the description, as the CVE payload does not detail the exact mechanism. No public exploits have been documented in the supplied information, but the high potential impact warrants prompt attention.