The vulnerability arises from improper control of filenames used in PHP include or require statements. An attacker who can influence the filename parameter may induce the application to include a local file, potentially revealing sensitive data or executing arbitrary code. The flaw can lead to information disclosure, code execution, or privilege escalation within the web server context.

The issue affects the WordPress Greenify theme from its initial release up to and including version 2.2. Any site deploying Greenify 2.2 or earlier is potentially vulnerable. Sites using newer releases are not affected unless the fix was omitted.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score of less than 1% suggests that, at the time of assessment, the likelihood of exploitation remains low, yet the vulnerability is still actionable. Because the flaw involves local file inclusion, an attacker could exploit it via crafted requests in the context of the website, making the risk real for exposed WordPress installations. The vulnerability is not listed in the CISA KEV catalog, but its high severity warrants prompt remediation.