The vulnerability results from improper control of the filename in an include/require statement in the Elessi theme’s PHP code, allowing a local file inclusion attack. An attacker can read arbitrary local files and can potentially execute code if they can supply a malicious file, thereby compromising data confidentiality and possibly escalating privileges.

WordPress sites running the NasaTheme Elessi theme on any version prior to 6.4.1 are affected. The flaw exists from the initial release through any revision below 6.4.1, with no lower bound specified. Site administrators should verify the theme version they deploy.

The CVSS score of 7.5 indicates high severity, but the EPSS score is under 1%, signifying a low expected exploitation probability at present. The vulnerability is not listed in CISA KEV. Exploitation typically requires an attacker to supply a crafted path to a locally stored file that can be included, which usually needs either local filesystem access or a preceding vulnerability that affords file uploads. Accordingly, the risk is moderate but warrants immediate attention to prevent potential data breaches or code execution.