This vulnerability in the Don-Themes Molla WordPress theme is an improper control of filenames used in include/require statements, allowing the execution of arbitrary local files. An attacker who can influence the parameter resolved by the include can read sensitive files or execute code if the PHP engine is permissive. The flaw is classified as a PHP Local File Inclusion and does not require remote file loading; it relies solely on local file paths.

The Don-Themes Molla theme for WordPress is affected, specifically all releases up to and including version 1.5.16. No other registered vendors or products are listed, and the vulnerability cuts across the entire version range before 1.5.16.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local attacker who can supply or manipulate input that is passed directly to an include or require statement. Successful exploitation could lead to information disclosure or code execution within the context of the authenticated user or, if the site is compromised, the entire webserver.