Improper validation of file paths in a PHP include statement allows an attacker to force the WordPress Fana theme to include arbitrary files from the local file system. This local file inclusion can lead to disclosure of sensitive configuration files or credentials and may provide an initial foothold for further exploitation if the site runs with elevated privileges.

The vulnerability exists in the WordPress Fana theme developed by thembay. All releases of the theme up to and including version 1.1.35 are affected. No other vendors or products are listed.

The CVSS score of 7.5 indicates a high severity. The EPSS score is under 1%, suggesting a low current exploitation probability, and the CVE is not in the CISA KEV catalog. It is inferred from the description that the vulnerability could be triggered by inputs that influence the include statement, such as certain URL parameters or form fields; however, the official description does not explicitly specify the exact attack vector. An attacker must be able to reach the WordPress installation and supply appropriate input; the local nature of the flaw does not permit remote code execution from the network, but it can expose privileged files that may assist in a broader attack.