The Houzez WordPress theme contains an Improper Control of Filename for Include/Require Statement flaw (CWE‑98). This flaw allows an attacker to specify arbitrary local file paths to the PHP include logic, potentially exposing sensitive server files. The CVE designation identifies this as a local file inclusion vulnerability, which may enable attackers to read files that should otherwise be inaccessible through the web interface.

Any installation of the Houzez theme for WordPress with a version earlier than 4.2.0 is affected; the issue is present from the earliest available release through all releases before the 4.2.0 update.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low but non‑zero exploitation probability. The vulnerability is currently not included in CISA’s KEV catalog. As the issue is a local file inclusion flaw, the attack likely requires an unauthenticated attacker to supply crafted input—such as manipulating query parameters or form fields that are passed to the theme’s include logic—to reference local files.