The Zota theme uses an include/require statement that accepts a filename without proper validation. This flaw allows an attacker to manipulate the filename argument and cause the theme to read arbitrary files from the local filesystem. The impact is primarily the disclosure of sensitive files, and depending on the server configuration, it could be leveraged to execute code or compromise the host.

WordPress sites running the Zota theme version 1.3.14 or earlier are affected. No host or OS details are provided, but the vulnerability is confined to the theme files installed on the WordPress instance.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1%, suggesting low current exploit activity, and the entry is not listed in CISA KEV. The likely attack vector is through a crafted URI or form value that influences the include/require statement, though the exact triggering mechanism is not detailed in the description.