The vulnerability is an improper control of filename for include/require statements in the Lasa WordPress theme, allowing a local file inclusion flaw (CWE‑98). If an attacker can influence the filename parameter, they may read sensitive files such as configuration or database credentials, or execute arbitrary PHP code by including a crafted file. This can lead to full compromise of the site and potentially the underlying server. The CVSS score of 8.1 indicates a high severity impact.

Affected is the Lasa theme from thembay, versions 1.1 and earlier. The theme is deployed on WordPress installations; any site running those versions is vulnerable.

The EPSS score of less than 1 % implies a very low current exploitation probability, perhaps because the flaw requires the attacker to supply an exploitable file path that the theme will include. It is not listed in the CISA KEV catalog. The likely attack vector is a web‑based request that passes a crafted file path to the theme, leading to local file inclusion. Exploitation requires that the site runs the vulnerable theme and that the include logic is reachable from the web.