The CVE describes an Improper Control of Filename for Include/Require Statement in PHP Program, formally known as a Local File Inclusion vulnerability. Exploitation allows an attacker to specify an arbitrary file path that is included by the La Boom theme, potentially exposing sensitive files or executing arbitrary code if a malicious PHP file is located on the system. This weakness is classified as CWE‑98 and carries a CVSS score of 8.1, indicating a high‑severity flaw that can impact confidentiality, integrity, and availability of the affected WordPress installation.

The vulnerability affects the SpyroPress La Boom theme, specifically all versions through 2.7. Any WordPress site that has installed La Boom version 2.7 or earlier is vulnerable. No further version details are available, so all installations using these older versions should be considered at risk.

The CVSS score of 8.1 reflects a significant threat, but the EPSS score of less than 1% indicates that the likelihood of exploitation is low at this time, and the flaw is not listed in the CISA KEV catalog. While the vulnerability is classified as a Local File Inclusion, the lack of explicit details in the description suggests that exploitation would require the attacker to influence the include path, possibly through a crafted request or by placing a malicious file on the server. Thus, the attack vector is likely remote but depends on attacker control of file paths or prior access to the file system.