The vulnerability in the WordPress Mitech theme allows an attacker to include arbitrary local files when the theme processes an untrusted filename. This can lead to the execution of malicious code from server‑side files, thereby breaching confidentiality, integrity, and potentially availability of the site content. The flaw is a classic filename control weakness, identified as CWE‑98.

WordPress sites that use ThemeMove’s Mitech theme version 2.3.4 or earlier are affected. The vulnerability applies to all installations of the theme from its inception through 2.3.4 inclusive. No other themes or WordPress core components are impacted.

The CVSS score of 8.1 places this flaw in the High severity range. However, the EPSS score of less than 1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Typical exploitation would require an attacker to supply a crafted request containing a malicious file path, or to already have write access to the server, to trigger the improper include. No public exploit code has been released, but the high severity warrants prompt remediation.