The Oshine theme contains an improper control of filename for include/require statements, allowing an attacker to specify arbitrary file paths that the PHP engine will read or execute. This flaw, identified as CWE-98, could enable the disclosure of sensitive files or, if executable PHP files are accessed, remote code execution. The description does not detail the exact input mechanism, but the likely attack vector is via a user-provided parameter that influences the include path within the theme's code.

The defect affects the WordPress Oshine theme developed by brandexponents. All releases prior to version 7.3.0 are vulnerable; versions 7.3.0 and newer have the issue fixed.

The CVSS score of 8.1 classifies the vulnerability as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The CVE description does not disclose the exact attack vector, and while CWE-98 implies that an attacker may manipulate input that determines include paths, the specific mechanism for triggering the flaw is not detailed in the public evidence.