The vulnerability is an improper control of the filename used in PHP include/require statements, allowing an attacker to execute a Local File Inclusion flaw in the Hostiko theme. This weakness can let a malicious actor read arbitrary files on the server, and in some configurations execute code, thereby compromising confidentiality, integrity, and availability as defined by CWE‑98.

The Hostiko theme for WordPress, produced by designingmedia, is affected in all releases prior to version 30.1. Users running any older version on a WordPress installation are subject to the flaw.

The CVSS score of 7.5 reflects a high severity level, while the EPSS score of less than 1% indicates a low current likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The LFI typically requires that a user can influence a filename that is passed to an include/require call—likely through a request parameter or theme configuration. If an attacker can supply a path that points to a local file such as /etc/passwd or a PHP script, they could read sensitive data or launch code execution, especially if the server permits local include files to be interpreted as PHP.