The vulnerability arises from improper control of the filename used in PHP include/require statements within the Greenmart WordPress theme. An attacker can manipulate request parameters to include local files, potentially executing arbitrary PHP code or reading sensitive files from the server. This flaw can be leveraged to gain unauthorized access or exfiltrate data stored on the web server.

Any WordPress site that has installed the Greenmart theme version 4.2.3 or earlier is affected. The issue covers all releases from the initial version up through 4.2.3, meaning any WordPress deployment that has not upgraded beyond that point is at risk.

The CVSS score of 8.1 marks it as high severity, yet the EPSS score below 1% indicates a low probability of active exploitation at present. The flaw does not require authentication and can be triggered via a crafted HTTP request, making it accessible to remote attackers. Because it is not listed in the CISA KEV catalog, there is no publicly confirmed exploitation, but the existence of the vulnerability warrants immediate attention.