The vulnerability arises from improper control of filenames passed to PHP include/require statements in the AncoraThemes Apollo WordPress theme. An attacker who can influence the filename path can direct the application to read arbitrary local files or, if writeable, execute malicious PHP code. This flaw is rated CVSS 8.1, indicating a high risk of compromising confidentiality, integrity, or availability of the affected site.

The flaw affects all installations of the Apollo | Night Club, DJ Event WordPress Theme from the first release through version 1.3.1. The targeted product is maintained by AncoraThemes and is used by WordPress sites that have installed this theme.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation probability. However, exploitation would likely occur via an HTTP request that supplies a crafted filename parameter to the theme’s include logic. No authentication or elevated privileges are required, which increases the threat surface for attackers on exposed sites.