The CVE exposes a flaw in the Magways WordPress theme’s handling of PHP include/require statements, allowing an attacker to supply arbitrary file names. Based on the description, it is inferred that if the attacker can supply a path to a local file or a file with executable PHP code, the theme will include the file. This may result in disclosure of sensitive server files and, if an attacker can place code in a local file, may lead to remote code execution. The weakness is identified as a CWE‑98 scenario where filename control is insufficiently validated.

Any installation of the Magways theme version 1.2.1 or earlier is vulnerable. The issue affects the unpacked theme code shipped under the vendor unfoldwp for use within WordPress sites.

The CVSS score of 8.1 reflects a high‑severity risk, while the EPSS score of less than 1 percent indicates that exploit activity is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves manipulating the theme’s file path selection via a crafted URL parameter or other user‑supplied input within the WordPress front‑end or admin interface. Once an attacker can control the path, the theme will include the specified file without proper validation, enabling the potential for local file disclosure or code execution.