This vulnerability is caused by improper control of the filename in a PHP include/require statement within the Enzio theme. The flaw allows an attacker to cause the theme to include arbitrary files from the server; if a PHP file can be forced into the include, the attacker may achieve code execution. The weakness is classified as a local file inclusion and is mapped to CWE-98.

Gavias Enzio – Responsive Business WordPress Theme. All releases older than 1.2.6 are affected; any WordPress installation using the theme in a version below 1.2.6 is at risk.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description to be through the web interface, where an attacker crafts a request that manipulates the filename parameter to point at system files or other files containing PHP code. If the attacker can read sensitive files, confidentiality is compromised; if the attacker forces execution of PHP code, code execution is possible.