This vulnerability is an improper control of the filename used in a PHP include/require statement, allowing an attacker to trigger Local File Inclusion within the Opal_WP Fashion theme. By manipulating path, an attacker can read sensitive files from the server’s filesystem and, if writable files are present, inject and execute arbitrary PHP code, compromising confidentiality, integrity, and availability of the site.

WordPress Opal_WP Fashion fashion2 theme, versions from the first release up to but not including 5.3.0. Any installation of this theme with a version less than 5.3.0 is affected.

The CVSS score of 7.5 classifies this issue as High severity. The EPSS indicates a very low exploitation probability (<1%) and the vulnerability is not listed in CISA’s KEV catalog. Attack is likely to be local, triggered through crafted requests that cause the theme to include unintended files. No remote download capability is reported, but local file reads or writes can lead to critical compromise if the web server’s user has write permissions.