WordPress installations that use the CleanSkin theme version 1.5.0 or earlier are exposed to a vulnerability that allows unauthenticated users to include arbitrary local files through the theme’s processing of user input. An attacker can specify file paths that are read and executed by the web server, enabling read access to configuration files, user credentials, or even execution of arbitrary code if the included file contains executable content. This flaw directly compromises confidentiality, integrity, and availability of the affected site.

The vulnerability applies to all installations of the AncoraThemes CleanSkin WordPress theme through version 1.5.0. No other plugins or themes are listed as affected.

The flaw has a CVSS score of 8.1, indicating high severity. Because the vulnerability is unauthenticated and can be triggered by any external user without credentials, the attack feasibility is high. No EPSS score is available, and the issue is not listed in CISA’s KEV catalogue, but the lack of mitigation measures and the wide use of WordPress themes suggest that exploitation could become common if a patch is not applied promptly.