The vulnerability is an improper control of the filename for include/require statements in PHP, allowing local file inclusion. An attacker can manipulate the include path to read arbitrary files on the server or execute PHP code, leading to information disclosure or full remote code execution, as the flaw is categorized under CWE‑98.

The BZOTheme GiftXtore WordPress theme is affected for all versions from the initial release through any version earlier than 1.7.7. This includes all installations using GiftXtore themes below version 1.7.7.

The CVSS score is 8.1, indicating a high severity. The EPSS score is reported as less than 1%, suggesting a low current exploitation probability and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a crafted web request that triggers the vulnerable include logic; an attacker who can influence the request may gain access to local server files or execute code.