The vulnerability arises from improper control of filenames in PHP’s include/require statements within the Edge‑Themes Cinerama theme. An attacker who can influence which file is included can force the application to read local files, potentially revealing sensitive data or executing server‑side code if the included file is PHP. This weakness can lead to confidentiality breaches and, in worst‑case scenarios, remote code execution if the attacker can supply a crafted filename that points to a PHP file on the server.

WordPress sites using the Edge‑Themes Cinerama theme version 2.9 or earlier are affected. No further version granularity is provided, but all releases in that range contain the flaw.

The CVSS score of 7.5 indicates a high risk severity. However, the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of active exploitation at present. Attack vectors are likely local or web‑based, requiring the attacker to construct a URL that manipulates the include path. If the site allows an authenticated or unauthenticated attacker to supply the filename parameter, exploitation could be straightforward.