The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, known as Local File Inclusion. An attacker can supply a file path to the theme and cause PHP to include arbitrary files on the server. This can expose sensitive files such as configuration documents, logs, or other data that should not be publicly accessible. While the description does not explicitly state that it can lead to code execution, the ability to read or potentially execute local files creates a serious confidentiality risk and may serve as a stepping‑stone for further exploitation.

Magze, a WordPress theme provided by unfoldwp, is affected in all releases up through 1.0.9. Any WordPress site that has not upgraded beyond version 1.0.9 or that still hosts legacy installations remains at risk.

The CVSS score of 8.1 demonstrates high severity. The EPSS score being less than 1% indicates that exploitation is currently unlikely, but the small probability does not eliminate risk. The vulnerability has not been included in the CISA KEV catalog, so no known active exploits are recorded. The exploit path is local; an attacker would need a vector that allows supplying the malicious file path to the include operation, such as through user input parameters or plugin interactions. Applying an upgrade that removes the vulnerable code is the most effective defense.