The reported vulnerability stems from an improper control of the filename used in a PHP include statement within the Select‑Themes Struktur theme. An attacker who can influence the include path may cause the application to load arbitrary local files, potentially exposing sensitive data or enabling remote code execution. This weakness is classified as CWE‑98 and carries a CVSS score of 8.1, indicating a high potential for compromise if exploited.

WordPress installations that use the Struktur theme from its initial release through version 2.5.1 are affected. All older releases, as well as the 2.5.1 build, retain the flaw.

The EPSS score of less than 1% suggests low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the high CVSS score reflects significant impact should the flaw be leveraged. The likely attack vector involves a web‑based request that manipulates the include path via user input, enabling the attacker to read or execute local files on the server.