Improper control of the filename supplied to PHP's include/require statement allows an attacker to read arbitrary local files and potentially execute code if the included file is interpreted as PHP. The flaw is classified as CWE‑98 (Improper Control of Filename). The impact is a high‑severity security issue that could expose sensitive configuration data, user content, or other secrets stored on the server, and could lead to further compromise of the web application.

The vulnerability exists in ThemeMove's SmilePure WordPress theme for all versions before 1.8.5, including the initial release. Any WordPress installation deploying the SmilePure theme and running a version older than 1.8.5 is potentially affected.

The CVSS score of 8.1 indicates a high severity with potential for widespread damage if exploited. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves using the theme’s file inclusion mechanism through a crafted request from an unauthenticated user, though the exact input path is not detailed in the available information and is inferred from the description of a local file inclusion flaw.