The flaw in the Magazine Saga theme originates from an unfiltered include/require statement that directly uses file names supplied by users. Since the path is not validated, an attacker can specify any readable file on the server, exposing configuration, code, or other sensitive data. This vulnerability is defined as a PHP Local File Inclusion and is catalogued as CWE‑98.

WordPress sites that install the unfoldwp Magazine Saga theme version 1.2.7 or earlier are affected. Any site running a pre‑1.2.7 theme version is potentially vulnerable.

The CVSS score of 8.1 marks the issue as high severity. The EPSS score of less than 1% indicates that exploitation is considered unlikely at the time of assessment, and the vulnerability is not included in the CISA KEV catalog. The inferred attack vector is local: an attacker would need to deliver a crafted include path via the theme’s configuration or through another vulnerability that permits reading or including arbitrary files. Successful exploitation would let an attacker read any file the web process can access, thereby exposing confidential information or undermining site integrity.