This vulnerability, classified as CWE-98, arises from the InHype WordPress theme allowing a local file to be included via a PHP include/require statement that is not properly controlled. An attacker who can influence the filename parameter may cause the application to read arbitrary files from the server or, in some configurations, execute code. The consequence is potential disclosure of sensitive information or execution of arbitrary PHP code, compromising confidentiality, integrity, and availability of the site.

The affected product is the InHype - Blog & Magazine WordPress Theme developed by dedalx, versions from the initial release through 1.5.2 inclusive. WordPress sites that have installed or activated these versions of the theme are vulnerable.

The CVSS base score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild at present, and the vulnerability is not recorded in the CISA KEV catalog. Likely attack path involves an unauthenticated or authenticated user submitting a crafted request that triggers the uncontrolled include operation in the theme. Successful exploitation could lead to reading sensitive files or executing PHP code.