The flaw arises from an uncontrolled filename passed to PHP’s include statement, allowing an attacker to read arbitrary files on the web server. If an attacker can place a PHP file on the server or influence the include path, the inclusion can lead to the execution of attacker‑supplied code. This vulnerability is classified as a PHP Remote File Inclusion weakness, identified as CWE‑98.

WordPress installations that employ the snstheme MBStore – Digital WooCommerce WordPress Theme version 2.3 or earlier are at risk. The advisory does not specify a particular PHP version or operating system, so any environment running the affected theme is potentially affected.

The CVSS score of 8.1 denotes high severity, while the EPSS score of less than 1% indicates low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that authentication is not required to trigger the LFI vector, and an attacker can initiate the attack by crafting a URL or input that controls the filename parameter. Once the LFI succeeds, the attacker could read configuration files, session data or, if the server allows it, execute arbitrary PHP code. Organizations should treat this as a high‑priority issue despite the low exploitation probability.