Technical impact
Improper validation of the filename used in a PHP include/require statement in the AncoraThemes Anderson WordPress theme allows a Local File Inclusion vulnerability. The flaw can allow an attacker to read sensitive files on the server. Based on the description, it is inferred that an attacker could also upload or execute code through the theme mechanism, which may ultimately lead to full code execution through the web application. This weakness is classified as CWE‑98.
Affected Systems
WordPress sites using the Anderson theme from AncoraThemes, with any installed version up through and including 1.4.2. All earlier releases are also affected, as the vulnerability persists across the entire version range listed by the CNA.
Risk and Exploitability
The CVSS score of 8.1 indicates a high severity of exploit. The EPSS score of less than 1 percent reflects a low current exploitation probability, though the vulnerability is known and listed by reputable advisory sources. The vulnerability does not appear in the CISA KEV catalog, but its presence in public advisories and the high CVSS suggest it should be treated seriously. The likely attack vector is manipulation of request parameters or crafted URLs to provoke the theme to include untrusted files, exploiting the lack of path validation. Based on the nature of the vulnerability, it is inferred that successful exploitation could lead to data compromise or complete remote code execution on the affected WordPress installation.
