This vulnerability arises from improper control of the filename used in PHP include or require statements in the Diza WordPress theme. The flaw allows an attacker to request a local file to be included, potentially exposing sensitive data or executing unintended code. It is classified as a CWE‑98 weakness. The impact is the ability to read or run local files on the server, which can compromise confidentiality, integrity, and availability of the site.

The affected software is the WordPress Diza theme developed by thembay, with affected releases up to and including version 1.3.15.

The CVSS score of 7.5 indicates a high severity vulnerability, while the EPSS score of less than 1 % suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The description implies that exploitation requires an attacker to supply a crafted request that influences an include/require call; once achieved, the attacker could read files such as /etc/passwd or, if a PHP file can be placed in the webroot, execute arbitrary PHP code. The prerequisite is access to the vulnerable parameter and the ability to construct the malicious request.