The vulnerability in the Ziston WordPress theme permits an attacker to control the filename used in a PHP include or require statement, allowing the inclusion of arbitrary local files. This flaw is classified as CWE-98, which denotes improper control of filename for inclusion statements. Based on the description, it is inferred that the vulnerability could enable an attacker to read files present on the server.

The affected product is the gavias Ziston WordPress theme, versions ranging from the earliest release up through any version less than 1.4.5. Users running any unsupported or older Ziston installation are susceptible to this issue.

The CVSS score of 8.1 indicates a high severity vulnerability. Its EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a crafted filename that influences the include or require statement, as the theme does not sanitize this input. Based on the description, it is inferred that the attacker could read arbitrary local files on the server.