This vulnerability arises from improper control of the filename used in PHP include/require statements, allowing attackers to perform a local file inclusion. The ability to include arbitrary files can expose sensitive configuration, credentials, or other confidential data, and in many cases can be abused to execute malicious PHP code on the server, compromising the integrity and availability of the site.

The Besa WordPress theme, distributed by thembay, is affected for all releases up through and including version 2.3.8. Any WordPress installation using these versions of the theme is vulnerable; versions 2.3.9 and later are reported by the vendor as fixed.

The CVSS score of 8.1 reflects a high severity due to the potential for remote code execution and wide impact on all sites using the vulnerable theme. The EPSS score of less than 1% indicates that public exploitation is rare or has not been observed, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector would involve manipulating a request that triggers the insecure include/require logic, but the precise exploitation steps are not detailed in the advisory. Given the high potential impact and the low observed exploitation probability, the vulnerability poses a significant risk if left unpatched.