The vulnerability stems from improper control of file names in an include or require statement, allowing an attacker to influence which file is loaded by the PHP interpreter. This weakness can expose arbitrary files on the web server, potentially leaking sensitive information such as configuration files or database credentials, and in some cases can enable the execution of malicious code if an attacker is able to include a controllable PHP file. The severity classification CWE‑98 highlights the failure to validate or sanitize user input that is used for file inclusion, thereby compromising confidentiality and integrity of the system.

The Gavias Oxpitan WordPress theme is affected. All installations of Oxpitan through version 1.3.5, inclusive of 1.3.5 and every earlier release distributed by Gavias, are vulnerable. The issue is specific to the theme’s file inclusion logic and does not affect the core WordPress application.

The CVSS score of 8.1 indicates high severity. However, the EPSS score of less than 1% suggests that exploitation is currently unlikely to be widely observed. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector is a crafted URL or form parameter that passes a malicious path to the vulnerable include() call, potentially allowing a path‑traversal attack and the inclusion of unwanted local files.