The vulnerability arises because the Blogbyte theme does not properly validate the filename supplied to PHP's include/require statements, allowing an attacker to influence which file is loaded. This flaw permits an attacker to read or execute arbitrary files on the server, potentially exposing confidential data or running malicious code.

The issue affects the unfoldwp Blogbyte WordPress theme versions through 1.1.1. Users running any iteration of the theme within this range are susceptible.

The CVSS score of 8.1 reflects a high severity, while an EPSS score of less than 1% indicates a low probability of widespread exploitation at the present moment. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply a crafted input that resolves to a path on the server, such as via a URL parameter. If successful, the attacker could read local files or, in some configurations, execute code, leading to a full compromise of the application.