The Unica theme for WordPress contains an improper control of filename for include/require statements, enabling a local file inclusion flaw. Based on the description, it is inferred that a remote user could supply a crafted path to cause the theme to read or include arbitrary files on the server. If such a file contains PHP code, this could lead to remote code execution, potentially exposing confidential data and compromising site integrity.

AncoraThemes Unica theme, used on WordPress installations, is affected from its initial release up through version 1.4.1. Any site running a version of Unica older than or equal to 1.4.1 is vulnerable.

The CVSS score of 8.1 marks this as a high severity vulnerability. The EPSS score is below 1%, indicating low current exploitation probability but the risk remains high if an attacker finds a use case. The vulnerability is not listed in CISA's KEV catalog. Attackers likely target the vulnerability via HTTP requests to the WordPress site, exploiting the theme's inclusion logic. Exploitation requires the ability to influence the include path; once achieved, the attacker could read sensitive files or execute arbitrary code, depending on the server configuration.