Improper control of the filename used in PHP include and require statements allows an attacker to request a local file from the server. If the attacker can force the inclusion of a file that contains PHP code, this can lead to execution of that code and compromise of the site. At minimum, the vulnerability enables reading of arbitrary files, exposing sensitive configuration or source code, and potentially leaking credentials or other secrets.

WordPress sites that have installed Elated-Themes Frappé theme version 1.8 or earlier are vulnerable. The issue applies to all releases from the earliest known version up to and including 1.8 inclusive.

The CVSS score of 8.1 classifies this as a high‑severity flaw, while an EPSS score of less than 1% indicates a low probability of exploitation in the wild at this time. The vulnerability is not currently listed in the CISA KEV catalog, but the potential impact of local file inclusion is significant. Attackers would likely need a way to supply a file path to the inclusion routine, which could be achieved through a crafted URL or a form that accepts filenames. If successful, an attacker could read sensitive files or execute arbitrary PHP code on the server.