The Bailly theme contains an improper control of the filename used in a PHP include/require statement, allowing a malicious actor to request arbitrary local files be read or executed. This weakness can expose sensitive configuration files, user data, or credentials, and if the included file contains PHP code, it could result in remote code execution. The vulnerability maps to CWE‑98, which indicates unchecked file inclusion.

All installations of the WordPress Bailly theme version 1.3.4 or earlier are affected. This includes any WordPress site that has the Bailly theme active, regardless of other plugins or server configuration. The issue is present from the earliest release up to and including 1.3.4.

The vulnerability has a CVSS score of 8.1, signifying high severity. Its EPSS score is less than 1%, indicating a very low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is local file inclusion via a crafted request or administrative action that triggers the vulnerable include. Although no publicly known exploits exist, an attacker who can influence the include path could read arbitrary files or execute malicious PHP code.