This vulnerability originates from improper handling of filename parameters in PHP include statements, allowing an attacker to force the Powerlift theme to include arbitrary local files. The resulting local file inclusion can expose sensitive data and may be leveraged to execute malicious code, compromising the confidentiality, integrity, and availability of the affected WordPress site.

It affects the Mikado-Themes Powerlift theme in all releases prior to version 3.2.1, which can be identified by the vendor/product name Powerlift for WordPress.

The CVSS score of 8.1 indicates a high severity, while the very low EPSS (<1%) suggests exploitation is uncommon but still possible. The vulnerability is not yet catalogued in the CISA KEV list. Based on the description, the likely attack vector is remote: an attacker can trigger the inclusion by manipulating a publicly exposed URL or input field where the theme resolves paths. Successful exploitation would require access to the web application's file system or the ability to influence the include path.