Improper control of the filename in the include/require statement of the Issabella WordPress theme allows an attacker to trigger PHP local file inclusion. The weakness, identified as CWE‑98, could enable the execution of arbitrary code or the disclosure of sensitive files on the server, compromising confidentiality and potentially allowing attackers to take full control of the website.

The vulnerability afflict all releases of the jwsthemes Issabella theme up to and including version 1.1.2, with the affected range described as "from n/a through <= 1.1.2." No specific WordPress core versions are mentioned, so any WordPress installation using these theme versions is potentially exposed.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests that, at present, the likelihood of automated exploitation is low. The theme is not listed in CISA’s KEV catalog. The most probable attack path is via a crafted HTTP request that supplies a file name to a vulnerable include/require call, a vector that an attacker can exploit from the web.