The vulnerability originates from improper control of the filename used in a PHP include/require statement. An attacker could supply a crafted filename that causes the application to include a local file. This could result in reading sensitive files such as configuration files, database credentials, or system files, and if an arbitrary PHP file is included, it could lead to remote code execution. The weakness is captured by CWE-98.

WordPress installations that have the thembay Aora theme version 1.3.15 or earlier installed and active are affected. No specific WordPress core versions are listed, so any site running the vulnerable theme is at risk.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is through a web‑based request that triggers the inclusion of a crafted file path, inferred from the description as the theme mismanages file names on the server side. The exploit would require an attacker to influence the input that determines the included filename.