Improper control of filenames in the ekommart WordPress theme creates a Local File Inclusion vulnerability. By manipulating the include/require statement, an attacker can read arbitrary files from the web server, potentially exposing sensitive configuration data or executing code if a malicious PHP file is included.

WordPress sites running the ekommart theme before version 4.3.1 are affected. The vulnerability applies to all Opal_WP ekommart installs that have not upgraded past 4.3.1.

The CVSS score of 7.5 indicates a high severity issue, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw is a Local File Inclusion; exploitation would require the attacker to supply a file path that the application processes, but no public exploit remains documented.