The CasaMia WordPress theme contains a Local File Inclusion flaw caused by uncontrolled use of filenames in PHP include/require statements, a weakness identified as CWE‑98. An attacker can supply a crafted path that resolves to any file on the server, allowing read access to sensitive data or execution of arbitrary PHP code. The potential impact ranges from information disclosure to full code execution depending on the files accessed.

AncoraThemes CasaMia – Property Rental Real Estate WordPress Theme is affected. All releases from the first published version through and including 1.1.2 contain the vulnerability; any site running 1.1.2 or an earlier version is at risk.

The CVSS score of 8.1 classifies the issue as high severity. Exploration probability is reported as less than 1 %, indicating a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would target the web application by manipulating query parameters or user inputs that are passed directly to include/require functions, exploiting the lack of input validation.