The vulnerability is present in the Nuss theme for WordPress where a filename supplied to a PHP include/require statement is not validated, which is a classic CWE‑98 flaw. This allows a local file inclusion attack, enabling an attacker to read arbitrary files from the server and potentially execute malicious PHP code if the included file is controlled by the attacker. The flaw can expose configuration files, user data, or other sensitive information on the web server.

WordPress installations that have the Nuss theme from uxper, version 1.3.3 or earlier, are affected. Any site using these versions of the theme is at risk.

The CVSS score of 8.1 classifies the issue as high severity. The EPSS score of < 1% indicates a low current exploitation probability, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is inferred to be an attacker supplying a malicious filename via a URL or form input that the theme processes, resulting in unauthorized file inclusion. Because the flaw involves local file access, exploitation requires the attacker to reach the WordPress environment through a web request, making the vulnerability accessible from the internet but dependent on the theme’s unchecked include handling.