An improper control of the filename used in PHP include/require statements within the VegaDays WordPress theme allows an attacker to manipulate the path and include arbitrary local files. This local file inclusion flaw could enable the disclosure of sensitive files such as configuration files or, in some configurations, execution of arbitrary PHP code. The vulnerability is associated with CWE-98.

AncoraThemes' VegaDays WordPress theme is affected, specifically all releases up to and including version 1.2.0. Users running these versions are susceptible to the described local file inclusion flaw.

The flaw carries a high CVSS score of 8.1, indicating significant potential impact if exploited. However, the overall probability of exploitation is low, with an EPSS score below 1% and no current listing in CISA's KEV catalog. Attackers can most likely exploit the vulnerability remotely through crafted HTTP requests that manipulate inclusion parameters, although the exact trigger depends on the theme's implementation. Until a patch is applied, this remains a relevant risk for exposed sites.