An improperly controlled filename used in a PHP include/require statement allows local file inclusion in the WordPress RealtyElite theme. The flaw can enable an attacker to read arbitrary files on the server, and if the payload is executed it can lead to code execution. This is a CWE-98 flaw that directly compromises file confidentiality and integrity and can ultimately threaten system availability.

The vulnerability affects the Real-web RealtyElite WordPress theme versions from the initial release up to and including 1.0.0. WordPress sites that use any of these affected theme versions are at risk.

The CVSS score of 8.1 indicates high severity. The EPSS score is below 1%, suggesting that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local file inclusion triggered by an untrusted parameter that the theme passes to an include/require function, potentially via a crafted URL or form input. An attacker could read sensitive files or, if the file read is executable, could possibly execute arbitrary code.