The Aviana theme contains an improper control of filename for the include/require statement, allowing an attacker to cause PHP to include arbitrary local files. Based on the description, it is inferred that the flaw may let an attacker read sensitive system files or, in some configurations, execute arbitrary PHP code if the included file is under the attacker's control. The weakness is classified as CWE‑98 and is described as a local file inclusion that may be abused to compromise confidentiality or integrity of the affected system.

WordPress sites that use the Mikado‑Themes Aviana theme version 2.1 or earlier. The vulnerability applies to any instance of the theme installed on a WordPress site, regardless of additional plugins or custom code, because the issue resides in the theme itself.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests that, as of the latest data, exploitation is unlikely. The flaw is not listed in CISA’s KEV catalog, but because the attack requires local file inclusion it could be leveraged by an attacker who can influence file paths or upload content to the server. Based on the description, the likely attack vector is an attacker who can influence file paths or upload content to the server. The likelihood and impact are best mitigated by applying vendor remediation immediately.