The flaw stems from an improper validation of filenames used in include/require statements in the Maia theme. Because the filename is not sanitized, an attacker can trigger the inclusion of arbitrary local files on the server. This may expose sensitive files or allow the execution of malicious code that the attacker can place on the filesystem.

WordPress users running the Maia theme version 1.1.15 or earlier. The vulnerability is tied to the thembay Maia theme, which is installed on the site’s theme directory and active within the WordPress environment.

The vulnerability scores 8.1 on CVSS, indicating high impact and medium to high exploitation complexity. The EPSS score is less than 1 %, suggesting exploitation is unlikely to be widespread yet. It is not listed in CISA KEV. An attacker can exploit the flaw by sending crafted requests that include a filename parameter, leading to local file inclusion and potentially remote code execution if the attacker can create or control the target file.