The vulnerability exists because the AncoraThemes Midi theme does not properly control the filename used in a PHP include/require statement. This flaw, classified as CWE-98, enables an attacker to include arbitrary local files via the server’s filesystem. The LFI can expose the contents of readable files and, if a PHP file is included, may allow execution of that code. The CVE data does not explicitly state that remote code execution is assured.

WordPress sites that have installed the AncoraThemes Midi theme with a version number no greater than 1.14 are impacted.

The CVSS base score of 8.1 indicates a high‑severity flaw, while the EPSS of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a publicly reachable request can supply an arbitrary path to the include/require call, and that no authentication or administrative privilege is required to exploit the flaw. Therefore, the likely attack vector is a publicly reachable request that supplies a path to the include/require statement.