The issue is an improper control of the filename used in PHP include/require statements within the WordPress Sala theme, classified as CWE‑98. This flaw permits an attacker to specify arbitrary local file paths that the theme will attempt to include, which can result in reading sensitive data or executing malicious code. The vulnerability is inherent to the theme’s file‑inclusion logic and can expose confidential contents or provide a foothold for further exploitation.

The vulnerable product is the WordPress Sala theme developed by uxper. All releases up to and including version 1.1.6 are affected; newer releases are not impacted. No other vendors or WordPress themes are listed as vulnerable.

With a CVSS base score of 8.1, the flaw is of high severity, yet the EPSS score is below 1 %, indicating a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the issue via unauthenticated HTTP requests that manipulate the theme’s file‑inclusion parameters; this attack vector is inferred from the description and is not explicitly stated in the advisory. If the attacker supplies a path that resolves to a writable or executable file, they could read sensitive data or execute arbitrary code.