The vulnerability arises from improper control of file names used in PHP include/require statements within the A‑Mart WordPress theme. The description indicates that a flaw can cause the application to include a local file on the server when an attacker manipulates the file name. While the exact exploitation method is not explicitly disclosed in the description, based on the wording it is inferred that a crafted request to a public URL that supplies a tampered filename parameter could trigger the vulnerability. This leads to the potential for reading sensitive configuration files or executing attacker‑supplied PHP code, which may result in data disclosure, credential theft, or full site compromise.

WordPress installations that use the A‑Mart theme from any unreleased build through version 1.0.2 are affected. The issue applies to all deployments of the theme regardless of other installed plugins or WordPress core versions.

The CVSS score of 8.1 classifies this bug as high severity. EPSS is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate exploitation likelihood at this time. Based on the description, we infer that the attack vector involves local file manipulation via the theme’s include logic, typically triggered through crafted requests to the site’s public URLs that pass a tampered filename parameter. An attacker does not need additional privileges beyond the ability to send HTTP requests to the vulnerable site.