The vulnerability is an improper control of the filename used in a PHP include/require statement within the consulting theme. This permits a local file inclusion that, if exploited, can read arbitrary files on the server or execute attacker‑supplied code. The weakness is categorized as CWE‑98. The impact is the potential compromise of confidentiality, integrity, and availability of the WordPress site. Based on the description, the likely attack vector involves a crafted request that manipulates the include path without proper validation.

WordPress sites that use the StylemixThemes Consulting theme with any version lower than 6.7.5 or without a patch. No other vendors or products are listed as affected.

The CVSS score of 7.5 indicates a high severity of the flaw. The EPSS score of <1% suggests a low exploitation probability at the moment, and the vulnerability is not listed in the CISA KEV catalog. However, local file inclusion can be a stepping stone to remote code execution if the attacker can upload or otherwise place malicious files in accessible directories. Because the vulnerability is in a theme that can be updated, the safest path is to acquire the patched version before any exploitation attempts surface.