The vulnerability is an improper control of filenames in the PHP include/require statement used by the Jannah theme. This is a CWE-98 flaw that allows an attacker to manipulate the filename parameter so that the server includes and executes a local file. This can expose sensitive configuration files, logs, or even allow the execution of arbitrary PHP code, compromising the integrity and confidentiality of the site.

WordPress sites that use the TieLabs Jannah theme with a version numbered 7.6.0 or earlier are affected. The flaw exists in all releases from the first available version up to and including 7.6.0.

The CVSS score of 8.1 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and it has not yet appeared in the CISA KEV catalog. Nonetheless, the attack vector likely involves submitting crafted requests that trigger the theme to include a user‑specified file, potentially requiring authentication or specific theme configuration access. If successfully exploited, an attacker could read sensitive files or execute malicious PHP code, leading to full site compromise.