An improper control of the filename supplied to PHP's include/require statement allows an attacker to craft a request that causes the application to load arbitrary files from the local filesystem. The vulnerability can expose sensitive files and, if the included file contains executable code, could lead to remote code execution. The weakness is identified as CWE‑98 and is limited to the Elated‑Themes The Aisle theme.

The vulnerability affects Elated‑Themes The Aisle theme for all versions prior to 2.9.1.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely to occur widely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no public exploits have been identified yet. The most probable attack vector is a crafted request to the theme’s PHP code that triggers the unvalidated include. Depending on the environment, this could let a remote attacker read sensitive files or, in some configurations, execute code.