This vulnerability arises from improper control of the filename in a PHP include/require statement within the CridioStudio ListingPro theme. An attacker could exploit this flaw to include and read arbitrary files on the server, potentially leading to confidentiality compromise or remote code execution if executable files are included. The weakness aligns with the Common Weakness Enumeration ID CWE-98.

The CridioStudio ListingPro theme from any released version up to, but not including, 2.9.10 is affected. This includes all earlier versions where the vulnerable code was present.

The CVSS score of 8.1 marks this issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is inferred to be a local file inclusion request that passes an unsanitized path to an include/require statement in the theme. Attackers would need to trigger the vulnerable code path; successful exploitation could result in read access to sensitive files or arbitrary code execution if the included file is self‑executing.