The vulnerability is caused by the theme’s PHP code improperly controlling the filename supplied to an include/require statement, allowing the attacker to trigger PHP local file inclusion. By manipulating the file path, a threat actor could read arbitrary files on the server or execute arbitrary PHP code, which directly compromises confidentiality, integrity, and could enable remote code execution. The weakness is identified by CWE-98, a flaw that permits inclusion of unintended files.

This flaw affects the Miion theme provided by zozothemes, for all releases up through version 1.2.7. Any WordPress site that has installed or activated the Miion theme at or below that version is vulnerable. The issue is confined to the theme code and does not extend to the core WordPress installation.

The CVSS base score of 7.5 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests that the current exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog. Although the description does not specify a particular input vector, it is inferred that the attack vector is likely through externally modifiable query parameters or form inputs that are passed to the vulnerable include call. Successful exploitation would require the attacker to have network reach to the web server hosting the site and the ability to influence the include parameter.