This vulnerability is an instance of improper control of filename for include/require statements in PHP, known as PHP Local File Inclusion. An attacker who can influence the value used in the include may read arbitrary files from the server, potentially accessing configuration files or credentials. Depending on the environment, this exposure can also lead to remote code execution if a malicious file can be placed in a readable directory and then included. The weakness is classified as CWE‑98.

The issue exists in the WordPress theme Remons, made by ovatheme. All releases from the first version up through 1.3.4 are affected, meaning any WordPress installation using the Remons theme that is at version 1.3.4 or earlier is vulnerable. Versions released after 1.3.4 are not impacted according to the CNA data.

The CVSS score is 8.1, indicating high severity. The EPSS score is below 1 %, so the probability of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a request that manipulates the include path or supply a malicious file within the site’s directory structure. When performed, the flaw permits reading local files that should remain confidential or, in the worst case, executing injected code that could compromise the entire site.