Improper control of the filename used in PHP's include/require statements allows local file inclusion in the Zota theme for WordPress. This flaw, classified as CWE-98, could enable an attacker to read arbitrary files or execute code if a PHP file is included. The vulnerability exists in all Zota releases from the earliest version through 1.3.8, allowing the vulnerable code paths to be exercised.

Commercial WordPress installations that use the Zota theme from thembay are affected. The vulnerability impacts all theme versions from the initial release up to and including 1.3.8. No other vendors or product lines were listed as affected.

With a CVSS score of 8.1, the flaw represents a high severity issue. The EPSS score of less than 1% indicates a low probability of being exploited in the wild at this time, and it is not present in the CISA KEV catalog. Based on the publicly provided description, it is inferred that an attacker could craft a request that supplies an arbitrary local file path to the include mechanism, thereby reading sensitive files or executing arbitrary PHP code where the web server has permission to reach those files.