The Fana theme incorporates an improper control of the filename used in PHP include/require statements, which is identified as CWE‑98. This flaw allows an attacker to have the application load unintended files residing on the server, potentially exposing sensitive data or executing arbitrary PHP code. The impact is limited to the web server running the theme; if the attacker can supply a crafted parameter to the vulnerable include call, the application may include local files that it should not access.

WordPress installations that employ the Fana theme from the initial release through version 1.1.28 are affected. Any site using thembay Fana theme within this version range, without additional hardening, carries the vulnerability.

The CVSS score of 8.1 indicates a high severity rating. The EPSS score is reported as <1 %, suggesting that the likelihood of exploitation at this time is low but not zero. The bug is not listed in the CISA KEV catalog. Exploitation requires that a publicly accessible endpoint contains the vulnerable code; an attacker can provide a parameter that points to a local file path, causing the application to include that file. No authentication is needed if the endpoint is exposed, and the attacker could read sensitive files or inject PHP code if a writable file can be manipulated. The likely attack vector is through the web interface, with the attacker supplying a crafted URL or form value.