Improper control of the filename used in a PHP include/require statement in the Stockholm theme allows Local File Inclusion. If an attacker can influence the included filename, they may read arbitrary files from the server or include and execute remote files, potentially escalating to code execution or sensitive data disclosure. The vulnerability is categorized as CWE-98, reflecting insecure handling of file paths.

WordPress installations that have the Stockholm theme version 9.14.1 or earlier are affected. This includes any site using the Select‑Themes Stockholm template from its initial release up through version 9.14.1. No specific WordPress core or PHP version constraints are stated in the advisory.

The CVSS base score is 7.5, indicating a significant severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation within the current timeframe, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves a crafted HTTP request targeting the vulnerable theme’s input that controls the include path, allowing an attacker with internet access to exploit the local file inclusion. Because it is a local vulnerability, it generally requires the attacker to be able to influence the request to the WordPress instance but does not rely on privileged user credentials.