The vulnerability arises from improper control of filenames used in PHP include/require statements. An attacker can supply crafted input that causes the theme to include arbitrary local files on the server, potentially exposing sensitive configuration files, credentials, or other confidential data. The impact is a theft of sensitive information and possible compromise of the site’s integrity, as attackers gain read access to files on the web server.

WordPress sites that use the AeroLand theme from ThemeMove. Versions vulnerable are all releases up to and including 1.6.6; newer releases are not affected.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Inferred attack vectors include direct manipulation of URL parameters or form fields that the theme passes to include/require, allowing the attacker to point to arbitrary files on the server. The threat remains significant because read access to critical files can lead to credential theft or further exploitation of the site.