The vulnerability arises from improper control of filenames in the Elated‑Themes Helvig WordPress theme, enabling local file inclusion via PHP include/require statements. This flaw is classified as CWE‑98 and could allow an attacker to read arbitrary files or execute malicious code on the server, thereby compromising the confidentiality, integrity, and availability of the hosted WordPress site.

WordPress installations that have installed the Helvig theme, versions up to and including 1.0. Any site that has not upgraded past this version is susceptible; versions prior to 1.0 are also affected, although the exact start point is unspecified.

With a CVSS score of 8.1, the vulnerability is high severity. EPSS indicates a very low exploitation likelihood (<1%), and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is local file inclusion driven by an attacker who can supply a file path to the theme’s inclusion logic, possibly via crafted URLs or internal requests.