The vulnerability is due to inadequate validation of file names used inside PHP include/require calls in the Urna WordPress theme. An attacker who can supply a crafted path can cause the theme to read or include arbitrary files stored on the server’s file system. The result is exposure of sensitive configuration or data files, and because the included content can be PHP code, the flaw could also enable execution of malicious code if the attacker can control the content of the included file. The description does not state whether execution is confirmed, so the precise impact remains limited to data but the potential for code execution is implied by the nature of the flaw.

WordPress installations that use the Urna theme version 2.5.12 or older are affected. The flaw exists only in the theme; the core WordPress framework and other plugins are not involved.

The CVSS score of 8.1 indicates a high severity, and the low EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability does not appear in the CISA KEV catalog. The most likely attack vector is the theme’s input handling, where an attacker can supply a path that bypasses normal validation and causes the theme to include a local file. Whether additional privileges are required to exploit the flaw is not specified in the CVE data, so it is unclear if an attacker needs administrative access or can operate with normal user rights.