The Mella theme contains improper control of the filename used in a PHP include/require statement, allowing an attacker to supply arbitrary local file paths through a vulnerable parameter. By exploiting this, an attacker can read sensitive files on the server or execute arbitrary PHP code if a writable file can be placed in a path that the theme will subsequently include.

All installations of the BZOTheme Mella theme with versions ranging from its initial release through 1.2.29 are affected. Any site that has one of these versions installed is vulnerable.

The vulnerability has a CVSS score of 8.1, indicating high severity, but its EPSS score is less than 1%, suggesting a low current threat of exploitation. It is not listed in the CISA KEV catalog. Likely exploitation would involve an attacker sending a specially crafted HTTP request to the vulnerable endpoint, including a file path that bypasses basic filtering, to read or execute local files.