The vulnerability is an improper control of filename for include/require statements in the Monki theme, classified as a Local File Inclusion flaw (CWE‑98). An attacker who can influence the argument to an include or require can cause the PHP interpreter to fetch and execute files from the local file system. This can lead to disclosure of sensitive files such as configuration or user data, and, if the attacker supplies a crafted file, may enable remote code execution within the WordPress environment.

The vulnerability affects the BZOTheme Monki WordPress theme, versions up to and including 2.0.5. Any site running one of these releases is potentially exposed.

The CVSS score of 8.1 indicates a high severity. The EPSS score is less than 1 %, suggesting that the likelihood of exploitation in the public space is currently low, and it is not listed in the CISA KEV catalog. Without explicit details on the trigger, it is inferred that the attacker needs the ability to supply input that is used in an include/require statement, likely via a user‑vulnerable endpoint or a crafted URL. If an attacker can reach that endpoint, they could read arbitrary files or execute malicious code; however, the exact exploit path is not detailed in the advisory.