The vulnerability is an improper control of filenames in PHP include/require statements within the Greenorganic theme for WordPress. An attacker can use the flaw to include arbitrary local files, which may result in the execution of malicious PHP code and compromise the confidentiality, integrity, and availability of the affected web server. The weakness is identified as CWE-98.

Products impacted are the ApusTheme Greenorganic WordPress theme with versions from the earliest released build through and including version 2.45. Any installation using one of these releases is susceptible.

The CVSS score of 8.1 classifies the issue as high severity, but the EPSS score of less than 1% indicates a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves manipulating a local include parameter within the theme’s code, which generally requires either local file access or authenticated administrative credentials. As the incident is a local file inclusion, external attackers would need a sufficient foothold on the server or a vulnerable input that can influence the include path.