The vulnerability arises from inadequate control of filenames in PHP include or require statements within the Myour theme, allowing an attacker to influence which files are loaded by the server. This flaw is categorized as CWE-98 and can enable the reading of arbitrary local files on the web server. In environments where the included files contain PHP code, the attacker may also be able to execute arbitrary code, effectively achieving remote code execution. The specific impact depends on the files the attacker can access and the permissions granted to the web server process.

WordPress installations using the Myour theme from any version up to and including 1.5.1 are affected. The vulnerability is present regardless of the WordPress core version, affecting the theme files located under wp‑content/themes/myour.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score of less than 1% suggests that, at the time of this analysis, the probability of exploitation in the wild is low, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to manipulate a filename parameter used in an include or require statement; the description does not specify whether user authentication is required, implying that the lfi may be exploitable through crafted requests without necessarily needing elevated privileges.