The vulnerability is a path traversal flaw that enables PHP Local File Inclusion in the Blanka theme. When an attacker supplies crafted input, the theme can include arbitrary files from the server, which may let the attacker read sensitive files or execute arbitrary PHP code. This results in a loss of confidentiality, integrity, and availability for sites using the affected theme.

The Blanka – One Page WordPress Theme from CocoBasic. Versions from the earliest available release through any version less than 1.5 are affected. The vulnerability exists in the theme files that handle path traversal.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts currently rare. The issue is not yet listed in CISA KEV, implying no known widespread exploitation. Attackers need only access the website's exposed interfaces that allow the theme to receive user‑supplied path parameters; thus, the attack vector is likely web based and requires only remote user interaction. The presence of a typical PHP include function combined with unsanitized input creates a straightforward exploit path for decoding malicious code.