The vulnerability is an improper control of the filename used in PHP include/require statements, enabling Local File Inclusion in the Grit theme. An attacker who can influence the include path could read sensitive files or upload and execute malicious code, leading to confidentiality and integrity compromise. This weakness is identified as CWE-98. The CVE description states that the issue affects the Grit theme up to and including version 1.0.1.

AncoraThemes sells the Grit WordPress theme. Any WordPress installation using Grit version 1.0.1 or earlier is vulnerable. No explicit operating system or PHP version is restricted in the advisory, so the risk is present in all environments that run the affected theme.

The CVSS v3.1 score of 8.1 classifies this as High severity. The EPSS probability is reported as less than 1 %, indicating that exploitation in the wild is considered rare at this time. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits are documented yet. The likely attack vector is through a crafted URL or form submission that passes a malicious filename into the theme’s include logic, which is inferred from the description of the improper filename control.