The vulnerability originates from improper control over the filename used in a PHP include/require statement, allowing an attacker to force the application to include an arbitrary local file. This flaw can enable the attacker to read sensitive files on the server or execute malicious code if the included file is treated as code, representing a local file inclusion flaw (CWE‑98).

The issue affects the beeteam368:VidMov WordPress theme. Any installation of VidMov with a version up through and including 1.9.4 is impacted; versions newer than 1.9.4 are presumed unaffected.

The CVSS score of 8.1 denotes high severity, but the EPSS score of <1% indicates that, at present, exploitation is considered unlikely. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely occur through crafted input that directs the include/require path, such as specific URL parameters or file upload fields, allowing the attacker to include a local file of their choice. No specific prerequisites beyond the ability to influence the include path are stated, so the attack vector is inferred to be local file inclusion via user-controlled input.