Based on the description, the vulnerability originates from a Path Traversal flaw (CWE‑35) that allows attackers to craft URLs containing sequences such as ".../...//" to include arbitrary local files in PHP scripts. This local file inclusion can lead to unintended disclosure of sensitive information or execution of malicious code if an attacker can place or access a controllable file on the server. The issue is confined to the GrandPrix theme’s handling of file paths and does not involve remote code execution directly, but the potential for code execution exists if the attacker controls the content of the included file.

Any WordPress site that has installed the Mikado‑Themes GrandPrix theme with a version number of 1.6 or earlier. The vulnerability is present from the earliest version through 1.6; versions released after 1.6 are unaffected.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild at the time of analysis. It is not listed in the CISA KEV catalog, suggesting no known mass exploitation campaigns. Based on the description, it is inferred that the likely attack vector is visiting a URL that triggers the vulnerable path traversal, so the attackability is relatively straightforward for an attacker with access to the site’s public interface.