The vulnerability arises from an improper control of the filename used in PHP include/require statements within the EcoGrow theme. This Local File Inclusion flaw allows an attacker to cause the server to read any file on the filesystem that the web server user can access. While the description does not confirm code execution, including a PHP file could grant the attacker the ability to execute code if such a file is on the server.

The EcoGrow theme by AxiomThemes, version 1.7 and earlier, is affected. WordPress sites that have any of these versions installed are vulnerable. Versions beyond 1.7 are not listed as affected and therefore are not impacted.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low current probability of exploitation, though it is not zero. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via a publicly accessible WordPress site that has the vulnerable theme installed, allowing an attacker to craft a request that forces inclusion of a selected file.