The vulnerability stems from improper control of a filename used in a PHP include/require statement within the WordPress Vizeon theme. An attacker can manipulate input that determines the file path, allowing inclusion of arbitrary local files. If an attacker can force the inclusion of PHP code or a web shell residing on the server, the exploit can result in remote code execution, data exfiltration, or privilege escalation. The weakness is classified as CWE‑98, indicating insecure file inclusion handling.

The Vizeon – Business Consulting WordPress theme supplied by gavias is affected. All versions prior to 1.2.1, from the earliest available version through the 1.1.1 release, are vulnerable. The vulnerability is present in the theme's legacy code that handles file inclusion logic.

The flaw carries a CVSS score of 8.1, indicating high severity. The EPSS score of <1% indicates a very low likelihood of exploitation at this time. It is not listed in CISA's KEV catalog, meaning no confirmed public exploits have been reported. The exploit requires an attacker to leverage local file inclusion by influencing the filename passed to PHP include/require statements. Successful exploitation could allow arbitrary code execution, data exfiltration, or privilege escalation on the affected WordPress site.