This vulnerability is an improper control of filename for an include/require statement in PHP, allowing an attacker to include arbitrary local files on the server. The weakness is classified as CWE-98. An attacker who can trigger the vulnerable code path could read sensitive files, manipulate application behavior, and potentially execute remote code if combined with other flaws. The impact is high because the attacker gains read access to any file the web server can read and may be able to manipulate PHP execution flow. The CVSS score of 8.1 reflects this significant risk.

WordPress installations that employ the ovatheme Ireca theme, version 1.8.5 or earlier. Any site running this theme within the specified version range is susceptible without a patch or update.

The CVSS score of 8.1 indicates a high severity vulnerability. Despite the low EPSS score (<1%) and the fact that it is not listed in the CISA KEV catalog, the potential exists for exploitation by attackers who can craft requests that trigger the vulnerable inclusion. The likely attack vector is via a web request that reaches the vulnerable PHP code, perhaps through query parameters or internal routing mechanisms, providing the attacker control over the filename. Given the local nature of the file inclusion, the threat is primarily to the application owner; widespread exploitation would require either authenticated access or additional exploitation steps to achieve remote code execution.