The Nika WordPress theme contains an improper control of filenames used in PHP include/require statements. Based on the description, it is inferred that an attacker could read sensitive files and potentially execute code if the included files contain executable scripts. This flaw is a classic case of improper input validation (CWE‑98).

Thebay Nika theme for WordPress. All releases from the initial public release up through version 1.2.8 are vulnerable. Versions beyond 1.2.8 are not known to be affected.

The CVSS score of 8.1 classifies this as high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and it is not currently listed in CISA’s KEV catalog. The likely attack vector is an external, web‑based request that supplies a malicious filename to an include statement. Based on the description, it is inferred that the attacker needs to be able to influence a parameter that resolves to the include call. Though the exploitation probability is low, the impact is significant, making it a high‑risk issue that warrants prompt remediation.