The vulnerability in Dahz Kitring theme versions 2.8 and lower originates from improper validation of file names used in PHP include/require statements. Attackers who can influence the path value can cause the application to include arbitrary files. This can lead to sensitive file disclosure and, if the included file contains executable code, to remote code execution on the web server. The flaw directly affects confidentiality, integrity, and availability of the WordPress site.

Any WordPress installation that uses the Dahz Kitring theme version 2.8 or earlier is impacted. No finer granularity of affected sub‑versions is provided; any deployment of the theme in that range is at risk.

The CVSS score of 8.1 classifies the issue as high severity. The EPSS value of less than 1 % indicates that, as of the analysis, exploitation activity is very low. The vulnerability is not listed in CISA’s KEV catalog, so there is no evidence of ongoing exploitation. The most likely attack vector is local file inclusion via manipulated parameters within the theme’s PHP code, requiring the attacker to have some influence over the included path, but not necessarily external access. The lack of a high EPSS score suggests the risk is presently moderate, but the high CVSS warrants prompt remediation.