The vulnerability arises from the thembay Diza WordPress theme, which fails to properly validate filenames used in its PHP include/require statements. This flaw allows a local file inclusion that could enable an attacker to read or execute arbitrary files on the server. This is a CWE-98 vulnerability. Based on the description, it is inferred that if the attacker can influence which file is included, they might read sensitive files or execute PHP code, leading to remote code execution.

The flaw affects WordPress sites that use the thembay Diza theme version 1.3.15 and earlier. Any installation using a newer version is not affected. No other WordPress themes or plugins are listed in the CVE record.

The CVSS score of 8.1 classifies the vulnerability as high severity, but the EPSS score of less than 1% indicates a very low current exploitation probability. The issue is not yet included in the CISA KEV catalog. Attackers are likely to exploit the vulnerability by manipulating input that the theme uses to build file paths for include/require calls. Such an attack typically requires access to modify theme parameters or the ability to upload files to the server. Given the lack of path sanitization, an attacker could include a locally stored PHP file and trigger remote code execution. This inferred attack vector is based on the nature of the flaw and the lack of defensive checks in the theme code.