This issue is a PHP Remote File Inclusion vulnerability arising from improper control of the filename used in an include/require statement. An attacker can supply a crafted filename to cause the application to read and execute arbitrary local files, potentially enabling code execution. The vulnerability can be triggered without authentication, exposing the site to unauthenticated attackers.

WordPress installations that use the Pixflow Massive Dynamic theme version 8.2 or earlier are affected. The flaw exists in all releases from the theme’s initial build through 8.2, meaning any site running one of those versions meets the CVE’s affected‑version definition.

The CVSS score of 9 indicates critical severity, and an EPSS score of 2% shows a moderate likelihood of exploitation. Although the flaw is not yet listed in CISA KEV, its absence does not diminish the risk. Exploitation requires an attacker to craft an HTTP request that causes the theme to resolve a path outside the intended directory; the payload is fully controlled by the attacker and can lead to arbitrary code execution.