An improper control of filenames in PHP include/require statements allows an attacker to include arbitrary files located within the WordPress installation. For the AncoraThemes Wizor's theme, the flaw appears up to version 2.12, enabling local file inclusion that could expose sensitive configuration files, user data, or allow execution of malicious PHP scripts. This compromises confidentiality and could lead to remote code execution on the affected server.

All WordPress sites that are running the Wizor's wizors-investments theme version 2.12 or earlier are affected. The vulnerability does not depend on a specific WordPress core version and applies to any installation where the theme is active.

The CVSS v3 score of 8.1 reflects high severity, while the EPSS score of less than 1% indicates a low likelihood of automated exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the typical attack vector would involve sending a crafted HTTP request that supplies a malicious filename to the vulnerable include statement, thereby exposing internal files or injecting code. Sites that allow such requests would be susceptible.