This vulnerability arises from improper control of the filename used in PHP include/require statements within the CWW Portfolio theme. It allows an attacker who can influence the include path to load arbitrary files from the local filesystem, potentially executing malicious PHP code or retrieving sensitive data. The flaw is categorized as CWE‑98.

The affected product is the WordPress theme CWW Portfolio owned by codeworkweb. Versions from the initial release up to and including 1.3.1 are susceptible; any release beyond 1.3.1 is not affected.

The CVSS base score of 7.5 indicates a high level of risk, while the EPSS score of less than 1% suggests a low probability of active exploitation at present. The vulnerability requires local access or the ability to craft a request that reaches the vulnerable include mechanism, so remote exploitation is not immediately evident. If an attacker can place a malicious file on the server or manipulate the request to point to a file containing PHP code, they could achieve arbitrary code execution or data disclosure.