The vulnerability is an improper control of filenames in a PHP Include/Require statement within the News Magazine X theme. It permits a PHP Local File Inclusion, allowing an attacker to read any file on the server that the web user can access, or to execute arbitrary code if a writable file such as a configuration or WordPress file is targeted. This weakness is catalogued as CWE-98, reflecting a lack of proper validation of file paths.

WordPress installations that deploy the News Magazine X theme from the earliest available release through version 1.2.37 are susceptible to this flaw. The CVE notes that all releases up to and including 1.2.37 contain the vulnerability, and earlier versions may also be impacted but are not explicitly listed.

The CVSS score of 7.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not flagged in the CISA KEV catalog. The likely attack vector is a web request that influences the include path — for example, a crafted URL parameter or form field that feeds into the include logic. Once the attacker can control the path, they may read sensitive files such as /wp-config.php or trigger code execution if a file with PHP code is placed in a writable location. Because the flaw is straightforward to exploit once discovered, the overall risk to affected sites remains significant.