The vulnerability is an improper control of the filename supplied to a PHP include/require statement. Attackers can supply arbitrary paths to the theme and cause the server to include local files. Because the theme does not validate or sanitize the input, an attacker can read sensitive files or execute arbitrary PHP code. Based on the description, it is inferred that this could lead to data theft, credential compromise, or full remote code execution on the web server. The weakness is mapped to CWE‑98.

The affected product is the WordPress Arrival theme developed by wpoperations, version 1.4.5 and earlier. All installations relying on Arrival 1.4.5 or older are vulnerable.

The CVSS score of 7.5 indicates high severity. The EPSS score of 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit references are provided in the CVE data. Based on the description, it is inferred that the flaw could be triggered by supplying arbitrary paths to the theme's include mechanism, possibly through URL parameters or form input. The exploit would allow an attacker to read sensitive files or execute arbitrary PHP code, depending on server permissions.