This vulnerability arises from improper control of the filename used in an include/require statement in PHP. The flaw allows an attacker to specify arbitrary local file paths to be included or read by the WordPress Nika theme. Because the included content is processed as PHP code, the attack can reveal sensitive configuration files, database credentials, or other private data, raising confidentiality concerns. The weakness is classified as CWE‑98.

All installations of the Nika theme for WordPress through version 1.2.14 are affected. This includes any WordPress site that has not yet updated the theme beyond that release. The thematic code is maintained by thembay and the issue applies to the entire product line up to that version.

The vulnerability has a CVSS score of 7.5, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, occurring when the theme processes input that determines the filename, but it could be triggered remotely if a user supply point controls that input indirectly.