The vulnerability in the Gavias Krowd theme stems from improper control of filenames used in PHP include/require statements. An attacker can manipulate the input to this inclusion mechanism and cause the server to read arbitrary files stored locally. The data exposed could include configuration files, credentials, or other sensitive content, and if an attacker can place malicious PHP code on the file system, execution of that code is possible, compromising the integrity and availability of the site.

This issue affects all installations of the Gavias Krowd WordPress theme with a version number lower than 1.5.0. The vulnerability is present in every release from the initial 1.0 version up to, but not including, 1.5.0. All WordPress sites that have this theme installed within that version range are potentially impacted.

The CVSS score of 8.1 classifies the flaw as high severity, and the EPSS score of less than 1% suggests that while exploitation is uncommon, it remains a realistic threat. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is an unauthenticated HTTP request to a vulnerable URL that triggers the inclusion logic, meaning anyone on the internet could potentially exploit the flaw without prior access.