This defect arises from an improper handling of filenames in PHP include/require statements, allowing a local file inclusion flaw (CWE‑98). An attacker may be able to read arbitrary system files or, if a malicious PHP file can be introduced, trigger execution of arbitrary code. The impact is the potential compromise of confidentiality, integrity, or availability of the host system.

ApusWP’s Domnoo WordPress theme when installed with any version up to and including 1.49. Any WordPress site using this theme is within the affected scope.

The vulnerability carries a high CVSS score of 8.1. The EPSS score is reported as < 1 %, indicating low current exploitation pressure, and it is not present in the CISA KEV catalog. Nonetheless, local file inclusion can lead to remote code execution if an attacker can deliver a crafted payload. Exploitation appears to depend on the attacker’s ability to influence the include path, and no publicly documented exploits exist.