The vulnerability arises from improper control of the filename used in an include/require statement in PHP, classified as CWE‑98. It permits a Local File Inclusion (LFI) that can allow an attacker to read arbitrary files or execute code within the WordPress installation, thereby compromising confidentiality, integrity, or availability. The high CVSS score of 8.1 reflects the potential severity of a successful exploitation.

The Greeny theme from AxiomThemes, in any version 2.6 or earlier, is affected. Deployments of this theme on WordPress installations fall under the scope of the vulnerability.

The EPSS score is less than 1 %, indicating a very low present exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the likely attack vector is a publicly accessible URL parameter that the theme passes to an include path; an attacker who can control that parameter could supply a local file path, potentially leading to remote code execution. The high CVSS highlights the severe impact if the vulnerability is exploited, and security teams should prioritize mitigating this risk.