The vulnerability arises from improper control of the filename in a PHP include/require statement within the GoTravel theme, allowing a local file inclusion flaw. An attacker who can influence the include path could read arbitrary files on the server, potentially exposing sensitive data such as configuration files, logs, or application secrets. The flaw does not directly provide remote code execution but can be used as a step toward more severe attacks if combined with other weaknesses.

Mikado-Themes GoTravel WordPress theme, versions from the initial release up to and including 2.1 are affected. No later versions have been identified as vulnerable.

The CVSS score of 8.1 categorizes this as a high‑severity vulnerability. The EPSS score is less than 1%, indicating that the probability of automated exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local context where the attacker can supply a path or influence the included file; however, the CVE entry does not detail a remote trigger, so it is inferred that the flaw requires some form of local or privileged access to the server environment.