The Sweet Jane WordPress theme contains an improper control over filenames used in PHP include/require statements. An attacker can supply a crafted value to the inclusion mechanism, causing the server to load a local file. The vulnerability may allow the attacker to read arbitrary files on the server or, if the included file contains executable PHP code, to run arbitrary code with the privileges of the web server. The flaw is classified as CWE‑98 and is rated CVSS 8.1 for high severity.

Affected systems are installations of the Sweet Jane theme from Elated‑Themes with versions up through 1.2, inclusive. No further version restriction is specified in the data.

The CVSS score of 8.1 indicates a high risk. The EPSS score is reported as less than 1 %, indicating a very low current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly documented, but based on the nature of the flaw it is inferred that an attacker can trigger the inclusion by manipulating URL parameters or by providing a crafted theme configuration entry. The vulnerability requires the target to be running a web server with PHP and WordPress installed, so it is a local or remote file inclusion that could lead to confidentiality or integrity compromise if successful.