The vulnerability is a path traversal flaw in the Frenify Arlo WordPress theme that permits PHP Local File Inclusion. By supplying a crafted path containing sequences like .../...//, an attacker may force the theme to include arbitrary local files. This can allow the disclosure of sensitive site data or execution of malicious code within the WordPress environment.

The flaw affects the Frenify Arlo WordPress theme up to and including version 6.0.3. WordPress sites deploying any of these versions are susceptible. No other vendors or products are explicitly enumerated in the CVE.

The CVSS score of 8.1 rates the flaw as high severity, while the EPSS score is under 1%, indicating a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based request to the affected theme’s PHP entry points, and the weakness originates from insufficient validation of path components as described by CWE‑35.