This vulnerability arises from improper validation or control of the filename parameter used in PHP include or require statements within the Buzz Stone WordPress theme. An attacker could exploit this flaw to perform Local File Inclusion (LFI), which may lead to arbitrary code execution or disclosure of sensitive files on the server. The affected versions are up to and including 1.0.2. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to full compromise of the affected web server, including disclosure of sensitive information, code execution, and disruption of service. The high CVSS score indicates significant risk to confidentiality, integrity, and availability of the system running the vulnerable theme.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor AncoraThemes communications for updates. Until a fix is available, consider disabling or removing the vulnerable theme to prevent exploitation.