This vulnerability arises from improper control of the filename passed to PHP include/require statements, allowing an attacker to read or execute arbitrary local files by manipulating the include path. The flaw, declared in CVE-2025-68984, exploits a Common Weakness Enumeration of CWE-98 and can lead to information disclosure or even code execution if the attacker can supply a crafted path. The impact is significant for systems where the theme processes user‑supplied parameters to build file paths.

The WordPress Puca theme from thembay, any version up to and including 2.6.39, is affected. Versions prior to 2.6.39 are also susceptible, as the vulnerability is present throughout that range.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog, but a likely attack vector is via manipulated parameters that influence the include path, potentially enabling local file inclusion. Provided the attacker can control those inputs, the risk escalates to full system compromise through execution of arbitrary local code.