The Diza theme for WordPress contains a flaw where the filename used in an include or require statement is not properly controlled, allowing attackers to specify arbitrary local files for inclusion. This Local File Inclusion (LFI) vulnerability can expose sensitive server data and, if an attacker provides a file that contains PHP code, could lead to remote code execution. The weakness corresponds to CWE‑98.

The vulnerability affects the Diza theme provided by thembay. All releases from the initial version up to and including version 1.3.9 are impacted. Site operators using any of these versions cannot be guaranteed safe.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests the exploitation probability is currently low. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can trigger the flaw by sending a crafted URL or form input that causes the theme to include an unintended file. Successful exploitation would likely not require authentication, but the resulting remote code execution would depend on whether the included file contains executable PHP code and the server allows it to run.