The vulnerability arises from improper control of the filename used in a PHP include/require statement within the don-themes Riode theme. An attacker can supply a crafted input that causes the theme to include an arbitrary local file, potentially exposing sensitive data such as configuration files, credentials, or source code, and in some cases may enable execution of malicious code if the attacker can manipulate included content. This flaw is commonly referred to as a PHP Local File Inclusion vulnerability and directly threatens the confidentiality and integrity of the WordPress installation.

WordPress sites that employ the Riode theme from don-themes. All releases of the theme through version 1.6.23 are affected, including the initial release (from n/a) up to and including 1.6.23.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted request that causes the theme to resolve a local file path, so a local directory traversal or the supply of a malicious file via an upload mechanism could be the likely attack vector. The flaw has a wide potential impact because any file on the server may be accessed, which could lead to data leakage or compromise of the entire WordPress site.