The vulnerability arises from the Aora WordPress theme's handling of user-supplied filenames in include/require statements. Because the theme does not validate or sanitize the supplied path, an attacker can cause PHP to include arbitrary local files, potentially disclosing sensitive data or allowing execution of malicious code if the attacker can place a PHP file and force its inclusion.

WordPress sites that use the Aora theme from any revision through version 1.3.9 are affected. The issue does not appear in releases newer than 1.3.9, so any site still running 1.3.9 or earlier is at risk.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score is below 1 %, showing a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw can be triggered via a normal HTTP request that supplies a crafted filename parameter, so sites with web‑accessible themes are potentially exposed. Because local file inclusion can yield code execution, the risk to confidentiality, integrity, and availability is significant if exploitable paths exist.