The vulnerability is an improper control over filenames used in PHP include/require statements, allowing attackers to include arbitrary files from the server. Because the attacker can read local files, sensitive information such as configuration files, credentials or other system secrets could be exposed and, if a writable location is available, code execution may also be possible, placing the CMS in a high risk category.

The flaw affects the Favethemes Houzez WordPress theme, specifically all versions from the earliest available through upload version 4.0.4. Any site that has installed the theme prior to 4.0.5 (or a later patched release) is vulnerable.

The CVSS score of 8.1 indicates a high impact for successful exploitation. The EPSS score of < 1% suggests a low probability of being actively attacked in the near term. The vulnerability is not yet listed in CISA KEV. Based on the description, it is inferred that an attacker can trigger the flaw by sending crafted HTTP requests to a WordPress site that uses the Houzez theme, such as manipulating query parameters or form inputs that are passed to an include/require statement. Successful exploitation would give an attacker read or potential execute capabilities on the affected server.