The CozyStay theme implements user‑supplied file names in include or require statements, which can lead to a local file inclusion vulnerability. The description states that an attacker can supply arbitrary file names that are then included by PHP; this could enable the execution of malicious PHP code on the server, although remote code execution is not explicitly confirmed in the advisory.

All installations of the CozyStay theme by LoftOcean that are version 1.7.0 or earlier, i.e., before the 1.7.1 release, are affected. WordPress sites that use this theme without upgrading remain vulnerable.

The CVSS score of 8.1 reflects high severity, yet the EPSS score of less than 1% indicates that exploitation is presently unlikely and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to require an attacker to supply a filename via a query parameter or form input that the theme concatenates into an include statement; successful exploitation would need the attacker to have the ability to write a malicious PHP file into a directory accessed by the web server and then trigger the vulnerable inclusion. While active exploitation is low at this time, the potential impact remains significant.