The Simen theme performs PHP include/require operations using filenames that are not properly controlled, a flaw classified as CWE‑98. This vulnerability can allow a malicious user to read any local file on the web server or, if a file that can be written by the attacker is included, execute arbitrary PHP code. The CVE explicitly states the issue results in local file inclusion rather than remote inclusion.

WordPress installations that use the Simen theme (Snstheme Snssimen) version 4.6 or earlier. All releases up to and including 4.6 contain the flaw; later releases have not been confirmed to be affected.

The CVSS score of 8.1 signifies a high severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog, suggesting no known public exploit exists at this time. Based on the description, it is inferred that the most likely attack vector involves a crafted request to the theme’s front‑end that supplies a user‑controlled filename to a vulnerable include/require call, though the CVE does not specify the exact trigger mechanism. Once exploited, the attacker could read sensitive files or execute server‑side code without needing privileged access.