The vulnerability is an improper control of filename for include/require statements in the PeakShops WordPress theme, as indicated by CWE‑98. The flaw permits PHP Local File Inclusion. Based on the description, it is inferred that an attacker could read local files or execute code if the LFI is exploitable, potentially exposing configuration files, credentials, or allowing arbitrary code execution, affecting confidentiality and integrity of the website.

The PeakShops theme by fuelthemes is vulnerable in all releases prior to 1.5.9. Versions 1.5.9 and later contain the fix. The vulnerability was identified in core theme files that accept filename parameters without validation.

The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1%, suggesting low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Without a vendor patch, an attacker would need to supply a crafted parameter to trigger the insecure include. The specific attack vector is not detailed in the vendor’s description, but is likely via an HTTP request that passes a filename to the theme’s logic.