The vulnerability is an improper handling of the filename supplied to PHP include/require calls, classified as CWE-98. This flaw allows an attacker to influence which files are read by the server, leading to the possibility of reading sensitive local files or executing arbitrary PHP code if a malicious file can be supplied. The impact includes loss of confidentiality and potential compromise of integrity and availability. The CVSS score of 8.1 indicates a high severity risk. The EPSS score of less than 1% suggests that observed exploitation activity is currently low and the vulnerability is not listed in the CISA KEV catalog.

WordPress sites that have installed the Urna theme by thembay, specifically versions from the earliest released build through version 2.5.7 inclusive. Any site that remains on these versions is potentially vulnerable. Newer releases are not listed as affected by the CVE data, but the absence of an explicit fix in the CVE requires sites to check for an updated theme from the vendor.

The CVSS of 8.1 classifies the flaw as high severity, while an EPSS score below 1% indicates a relatively low likelihood of current exploitation. The attack vector is inferred to be remote: an unauthenticated adversary can trigger inclusion by providing a crafted file path through an HTTP request, assuming the theme does not sanitize the input. Successful exploitation could read arbitrary server files and, if a PHP payload can be delivered, lead to remote code execution. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been identified as a known exploited vulnerability by the U.S. government.