The vulnerability is an improper control of the filename used in a PHP include/require statement, classified as CWE‑98. By manipulating the filename argument, an attacker can include arbitrary files from the local filesystem, potentially reading sensitive files or executing malicious code. The flaw directly compromises confidentiality, integrity, and availability of the affected WordPress installation.

All installations of the Pippo theme provided by goalthemes with a version of 1.2.3 or earlier are affected. The vulnerability applies to all releases from the first documented build through 1.2.3; versions beyond 1.2.3 are not impacted.

The CVSS score of 8.1 indicates a high severity vulnerability, while the EPSS score of "< 1%" suggests a low likelihood of exploitation at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a Local File Inclusion that an attacker could trigger by supplying a crafted filename in a request, such as via a URL parameter or form input. Successful exploitation could allow the attacker to read restricted files or execute arbitrary PHP code, thereby fully compromising the affected WordPress site.