The vulnerability is an unrestricted file upload flaw that allows an attacker to upload files of dangerous types to the WordPress KALLYAS theme. This is an input validation weakness (CWE‑434) where the theme does not properly filter or validate the MIME type or file extension of uploaded files. The description does not explicitly state that the uploaded file will be executed, but the potential exists for code execution if a malicious script is uploaded.

All installations of the hogash KALLYAS theme from the first release through version 4.22.0 are affected. Any WordPress site that uses this theme directly or via a child theme is vulnerable.

The CVSS score of 9.9 marks this as a critical vulnerability, and the EPSS score of less than 1% indicates a very low but non‑zero probability of widespread exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers could exploit the flaw by uploading a crafted file through the theme’s file upload interface if the web server accepts the file and later serves or executes it.