The vulnerability arises from the theme's PHP code failing to properly validate filenames used in include/require statements. The result is that an attacker can influence which local files are loaded, potentially leaking secrets or executing malicious code. The impact range is from information disclosure to full compromise if an attacker can control the file path.

WordPress sites using the Bringthepixel Bimber – Viral Magazine WordPress Theme version 9.2.5 or earlier are affected.

With a CVSS score of 8.8, the issue is considered high severity. The EPSS score is less than 1%, suggesting a low but nonzero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, via crafted URLs that trigger the vulnerable include mechanism, but requires the affected theme to be active.