The vulnerability is caused by improper control of filenames used in PHP include/require statements within the Besa theme, allowing an attacker to manipulate the path and include unintended local files. This flaw can lead to disclosure of sensitive contents or, if the attacker can supply executable code, to the execution of arbitrary PHP code, effectively compromising the site. The description labels it as a PHP Remote File Inclusion, but the core issue is the same local file inclusion mechanism that can be leveraged for broader attacks.

WordPress installations using the Besa theme from any version up to and including 2.3.15 are affected. The vendor thembay directly provides the theme, and there is no indication of later releases before 2.3.15 being fixed within the supplied data.

With a CVSS score of 8.1 the vulnerability is considered high severity. The EPSS score of less than 1% indicates that, as of the latest assessment, exploitation attempts are rare, and the issue is not listed in the CISA KEV catalog. Nonetheless, the flaw can likely be triggered through a crafted request to the theme’s include functionality, potentially from a remote attacker if the theme’s front‑end is publicly reachable. The low EPSS does not mitigate the risk, as the impact is significant for compromised sites.