The flaw is an improper control of filename for include/require in PHP, allowing an attacker to trigger local file inclusion. By supplying a crafted filename, an attacker can read arbitrary files on the server or execute malicious PHP code, potentially exposing sensitive data such as configuration files or credentials. This vulnerability is identified as CWE‑98.

The issue impacts WordPress installations that use the unfoldwp Magazine Elite theme in any version through 1.2.4. Any site running this theme before reaching a patched release is potentially vulnerable.

The CVSS score of 8.1 indicates high severity, meaning confidentiality, integrity, and availability could be compromised if exploited. The EPSS score of less than 1% suggests current exploitation is low, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a web request that includes a user‑controlled filename supplied to the theme’s PHP include/require calls, which is inferred rather than explicitly stated.