The Ronneby Theme Core plugin contains an unsanitized file path used in a PHP include or require statement. This flaw, identified as CWE‑98, allows an attacker to request arbitrary local files on the WordPress file system. If a malicious PHP file can be included, the vulnerability could lead to code execution; this effect is inferred from the description.

WordPress installations that use the DFDevelopment Ronneby Theme Core plugin version 1.5.68 or earlier are affected. Any site employing this version of the plugin across all WordPress environments is at risk.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of immediate exploitation. The flaw is not listed in CISA KEV. Exploitation likely requires the attacker to control a request that the plugin processes—such as a query string or form field containing the file path. Once the attack vector is established, the attacker can read sensitive files or, if a PHP file is included, execute arbitrary code.