The vulnerability arises from improper control of the filename used in PHP's include/require statements, allowing a Local File Inclusion (LFI) flaw. This weakness can be leveraged by an attacker to read arbitrary files residing on the server, potentially exposing configuration files, credentials, or source code. In the worst case, information gathered through LFI can aid further exploitation, compromising confidentiality of the system.

WordPress theme Networker from the vendor codesupplyco is affected through version 1.2.0. Any site using this theme version is potentially vulnerable; newer releases are not listed as impacted.

The CVSS score of 8.1 categorises this flaw as High severity. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA's KEV catalog. Likely attack vectors involve a local attacker with access to the web application who can manipulate the filename parameter in the include/require logic, often via crafted HTTP requests. An attacker could therefore read sensitive local files and analyze server configuration.