The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, allowing local file inclusion in the Magty theme. An attacker can supply arbitrary file paths to the PHP include mechanism, potentially reading sensitive files or, if the file is PHP executable, executing arbitrary code. The flaw carries a CVSS score of 8.1, indicating medium to high severity with significant impact on confidentiality and integrity.

All installations of the Magty theme on the WordPress platform up to and including version 1.0.6 are affected. The theme is maintained by unfoldwp under the product name Magty.

The EPSS score of less than 1% suggests that exploitation attempts are uncommon, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score indicates a high potential for damage if exploited. The likely attack vector involves an attacker manipulating input that is passed directly to an include or require statement, such as a URL parameter or form field. Successful exploitation can expose sensitive files, log data, or allow arbitrarily code execution within the WordPress environment.