This vulnerability in the Rally theme for WordPress stems from improper control of the filename used in PHP’s include/require statement. The flaw can allow an attacker to specify arbitrary file paths, resulting in Local File Inclusion. It is inferred from the description that if the attacker can cause a writable file to be included, the included file may execute as code, providing a path to remote code execution. The weakness is identified as CWE‑98.

The issue affects the Rally theme distributed by axiomthemes, from its first release through version 1.1. Any WordPress site that has installed any of these versions is potentially vulnerable. The vulnerability is contained within the theme; no specific WordPress core versions are implicated.

The CVSS score of 8.1 marks the issue as high severity, but the EPSS score of <1% indicates a very low probability that a scriptable exploit is actively used in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. It is inferred that the likely attack vector is Local File Inclusion, and remote code execution would depend on the presence of writable files or chained exploits to inject malicious code.