The vulnerability is an unauthenticated Local File Inclusion flaw in the Ambient WordPress theme versions 1.7 and earlier. This weakness permits an attacker to supply a crafted file path that the theme processes, allowing read access to arbitrary files on the web server such as configuration or database files, and in some configurations could lead to execution of malicious code. The flaw is categorized as Improper Control of Filename for Include/Require (CWE‑98).

WordPress sites employing the Ambient theme from Elated‑Themes, versions 1.7 or earlier. No further version details are provided in the advisory.

The CVSS score of 8.1 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the inclusion is unauthenticated, any visitor to the vulnerable endpoint can trigger the flaw; therefore the local attack vector is likely 'Local'. Once triggered, an attacker could read arbitrary files or introduce code that may be executed in the WordPress context. The lack of publicly known exploits does not diminish the potential threat, as the flaw is straightforward to exploit with a URL containing a directory traversal pattern.