The vulnerability is an improper control of filename for include/require statements in PHP, allowing an attacker to read arbitrary files from the server’s filesystem. This Local File Inclusion flaw could enable the disclosure of sensitive data and, if misused, allow execution of arbitrary code via inclusion of malicious payloads. The weakness is identified as CWE‑98 and directly impacts the confidentiality and integrity of the affected WordPress site.

WordPress installations using the Rozy – Flower Shop theme version 1.2.25 or earlier are susceptible. The issue spans all releases from the earliest available through version 1.2.25.

With a CVSS score of 8.1, the flaw is considered high severity. The EPSS score is < 1 %, indicating a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector involves crafting a request that causes the theme’s PHP code to include a user-supplied filename, which an attacker could manipulate to access internal files.