WordPress Glamer theme versions up to 1.0.2 contain an improper control of the filename used in a PHP include statement, allowing attackers to trigger local file inclusion. The flaw, identified as CWE‑98, can enable the disclosure of arbitrary files residing on the web server, including configuration files, credentials, and other sensitive resources that the web process can read.

The vulnerability affects the Glamer theme supplied by themeuniver, all releases through and including version 1.0.2 of the WordPress plugin.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which further indicates it is not a widely weaponized exploit. Based on the description, it is inferred that the attack vector would involve a remote web request that triggers the vulnerable include logic, allowing an attacker to read local files provided the web user has sufficient file system permissions. The impact is limited to confidentiality, as the flaw does not directly threaten data integrity or availability.