The vulnerability is an improper control of filenames supplied to PHP include/require statements in the Academist WordPress theme. This flaw allows an attacker to specify arbitrary file paths, potentially leading to the reading or execution of unintended files, thereby compromising confidentiality or integrity and enabling remote code execution.

The affected product is the Elated‐Themes Academist theme for WordPress, versions earlier than 1.3. No specific version numbers are listed, but all releases identified as < 1.3 are vulnerable.

The CVSS score of 8.1 indicates a high severity level. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based input that influences the include/require function, such as a crafted URL or form parameter. An attacker could supply a path to sensitive files or inject a PHP file to be included, potentially achieving remote code execution if the included file is processed by the server.