The vulnerability is an improper control of the filename used in an include/require statement in PHP. It allows an attacker to force the application to include a local file, which can be crafted to execute arbitrary PHP code. This flaw is identified as a PHP Remote File Inclusion, mapping to CWE-98, and it can compromise the confidentiality, integrity, and availability of the affected WordPress site.

StylemixThemes Masterstudy theme is impacted. All installations using versions prior to 4.8.126—including all releases preceding that version—are vulnerable. The theme is a WordPress plugin that processes user input to build include paths, enabling the exploitation when a user supplies a specially crafted parameter.

The CVSS score is 7.5, indicating high severity. The EPSS score is less than 1%, indicating a low probability that the vulnerability is being actively exploited at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is a crafted request that causes the theme to include a malicious local file, taking advantage of an unrestricted include path. Successful exploitation could result in the execution of arbitrary PHP code on the server.