The vulnerability is an improper control of filenames used in include/require statements within the ThemeSphere SmartMag theme. This flaw allows an attacker to cause the theme to include arbitrary local files, potentially enabling the reading of sensitive files or, if the supplied file contains executable PHP code, remote code execution on the vulnerable WordPress site. The weakness aligns with CWE‑98, "Improper Control of Filename for Include/Require Statement".

The affected product is the WordPress SmartMag theme by ThemeSphere. All releases up to and including version 10.3.0 are impacted, as indicated by the vendor’s version range. No specific sub‑versions beyond this upper bound are mentioned.

The CVSS score of 7.5 signals a high severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation would likely involve supplying a crafted filename to a vulnerable include path, possibly via a URL parameter or theme configuration. Given that the inclusion is limited to local files, the attacker could read files or, if PHP code can be provided locally, achieve code execution. The overall risk remains moderate for environments where the theme handles untrusted input.