The SetSail theme for WordPress contains an improper control of filename for include/require statements. The flaw allows an attacker to specify arbitrary local file paths, which can result in reading sensitive files or executing code that appears within the application. The weakness is identified as CWE‑98 and can lead to disclosure of confidential data or remote code execution if an attacker can place malicious content in a file that the theme will include.

WordPress users who have installed the SetSail theme version 1.8 or earlier are affected. This includes any site using SetSail n/a through 1.8.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% shows a low probability of exploitation at this time and the vulnerability is not listed in CISA’s KEV catalog. The issue is typically exploitable via the website’s front‑end or through user input that influences the include path; the specific attack vector is inferred because the description does not disclose it directly.