The flaw allows an attacker to provide a crafted value for a filename that is then used in a PHP include/require statement. The improper control of that filename can lead to PHP Local File Inclusion, enabling reading of arbitrary files on the server or the inclusion of malicious PHP code. The weakness is mapped to CWE‑98, which describes improper handling of filenames in includes.

The vulnerability exists in the shinetheme Traveler WordPress theme for all releases prior to version 3.2.6. Any WordPress site that has installed Traveler 3.2.5 or earlier, or has not yet upgraded to 3.2.6, is affected.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to inject a crafted path value through a URL parameter or form field; if successful, the theme could include a local file that contains malicious PHP, potentially leading to remote code execution. The overall risk remains high, but the likelihood of an active exploit in the wild is currently low.