The vulnerability arises from improper control of filename parameters within an include/require statement in the WordPress Select Core plugin. An attacker who can supply a crafted filename can cause PHP to include arbitrary local files, which may allow execution of injected code or disclosure of sensitive content. This weakness is classified as CWE‑98 and can compromise the confidentiality, integrity, and availability of the affected WordPress installation.

The flaw exists in the Select Core plugin from the Select‑Themes vendor, affecting all released versions prior to 2.6. Any WordPress site that has the Select Core plugin installed with a version lower than 2.6 is potentially vulnerable.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to influence the include path, likely through plugin configuration or user input, and would succeed when the site allows inclusion of local files without proper validation.