This vulnerability occurs because the Grip theme allows an attacker to manipulate the filename used in a PHP include/require statement. The flaw could enable the execution of arbitrary PHP code or reading of sensitive files on the server. Because the underlying weakness is CWE-98, the attack can compromise confidentiality and integrity of the site and could lead to full compromise of the web application and underlying system.

All publicly available versions of the Candid themes Grip theme from the first release through version 1.0.9 are affected. The issue consists of uncontrolled file paths in the theme’s code, which means any site running these versions is vulnerable until an updated theme is installed.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1 % shows that the probability of exploitation in the wild is low, and the issue is not currently listed in CISA’s KEV catalog. Nonetheless, attackers could exploit the flaw using a crafted URL or form input that points to sensitive server files or remote resources, with a threat vector that is likely local or web‑based. The risk is therefore moderate to high if the site is publicly exposed.