The vulnerability arises from improper control of filenames used in PHP include/require statements within the Winnex theme. It enables an attacker to execute a local file inclusion by providing crafted input to the theme’s file handling logic, potentially allowing the reading of arbitrary files on the web server and possibly the execution of malicious scripts, thereby compromising data confidentiality and integrity.

WordPress sites that use the Gavias Winnex theme version 1.3.2 or earlier are affected. All releases from the earliest available version up to 1.3.2 are vulnerable; upgrading to a newer release removes the flaw.

The CVSS score of 8.1 indicates high severity. The EPSS value of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a web‑based request to the theme’s endpoints that includes a malicious filename parameter. Successful exploitation would require the attacker to supply such a request; control of local files may enable further data leaks or code execution if attacker‑supplied files are interpretable by PHP.