The vulnerability is an improper control of the filename used in a PHP include or require statement. An attacker can manipulate the include path and force the WordPress theme to load local files. This allows the attacker to read sensitive files, such as configuration files, and in some cases execute arbitrary PHP code if the attacker can write to included files or includes a PHP file that executes code. The weakness is categorized as CWE‑98, a classic local file inclusion flaw.

Mikado‑Themes Malgre WordPress theme versions up to and including 1.0.3 are impacted. Versions before 1.0.3 are also affected as the issue exists throughout the series up to the stated maximum release. The specific product is the Malgre theme for WordPress.

The CVSS base score is 8.1, indicating high severity. The EPSS score is reported as less than 1 %, suggesting that, at the time of analysis, the likelihood of exploitation is very low but not zero. The vulnerability is not currently featured in the CISA KEV catalog. Exploitation requires an attacker to send a crafted HTTP request that triggers the theme’s unsanitized include logic; no physical access or privileged credentials are needed. Given the low EPSS, passive monitoring may delay detection, but the high CVSS means that a successful exploitation would lead to significant impact.