The vulnerability arises from improper control of the filename in a PHP include/require statement within the Werkstatt theme, allowing an attacker to specify local files for inclusion. Based on the description, it is inferred that the flaw can enable the reading of sensitive files on the server. The weakness is classified as CWE‑98.

WordPress installations that use the fuelthemes Werkstatt theme with versions older than 4.8.3 are affected. All releases prior to the stated 4.8.3 update are vulnerable.

The CVSS score of 8.1 categorizes the issue as high severity. Its EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request that triggers the theme’s include logic, allowing the attacker to control the file path.