The vulnerability is an improper control of filename for include/require statements in PHP, also referred to as PHP Remote File Inclusion. It permits local file inclusion on a WordPress site using the JanStudio Gecko theme. This weakness enables an attacker who can influence the file parameter to read local files or, if they can influence execution, to run arbitrary PHP code. The weakness corresponds to CWE‑98 and is primarily an integrity and confidentiality compromise, with the potential to achieve full system compromise if the included file contains malicious PHP code.

All installations of the JanStudio Gecko WordPress theme with version 1.9.8 or earlier are affected. No further version specificity is listed; all releases up to and including 1.9.8 remain vulnerable.

The CVSS base score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the theme’s file inclusion mechanism, which can be triggered by manipulating the file path parameter. Exploitation requires the attacker to have the ability to send crafted requests to the WordPress site, which is feasible for publicly accessible sites.