The vulnerability resides in Mikado‑Themes FiveStar theme version 1.7 or earlier, where an include/require statement accepts unsanitized filenames. An attacker can potentially supply a path that causes the application to read arbitrary files or even execute malicious PHP scripts. This flaw is catalogued as CWE‑98 and could lead to the disclosure of sensitive information or the execution of harmful code if the included file contains executable content.

WordPress installations that use the FiveStar theme from Mikado‑Themes, specifically all releases up to and including version 1.7. Any site deploying these versions is susceptible; newer versions are not affected.

The CVSS base score of 8.1 marks the flaw as high severity. The EPSS score of less than 1% indicates a currently low likelihood of exploitation, though this may change as attackers discover ways to bypass controls. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely require the attacker to influence the indicated filename string, potentially through URL manipulation or by creating a crafted file on the local server. Successful exploitation could permit reading of restricted files or execution of arbitrary code, thereby compromising confidentiality, integrity, and availability of the affected WordPress site.