The Blogprise WordPress theme contains a flaw in which a filename supplied to a PHP include or require operation is not properly validated. This improper control of the filename allows an attacker to read or include local files, which can lead to arbitrary code execution when a path traversal chain reaches a PHP file or when an attacker gains control of the input path. The vulnerability maps to CWE‑98, Local File Inclusion.

WordPress installations using the Blogprise theme version 1.0.9 or earlier are affected. The vulnerability was identified in all releases of Blogprise up to and including 1.0.9, regardless of other WordPress components.

The CVSS score of 8.1 indicates a high severity risk. EPSS is listed as <1%, suggesting a low overall exploitation probability at the time of assessment. The issue is not currently featured in CISA KEV. Attackers would need to supply a crafted filename parameter via a publicly accessible URL or form, which indicates the likely attack vector is a web‑based local file inclusion attempt. Successful exploitation could compromise the entire site, leading to data disclosure, defacement, or full remote code execution.