The flaw occurs when the Zentrum theme processes a filename provided by a user and passes it directly to a PHP include or require statement without proper validation. This allows an attacker to read arbitrary files on the server or execute code residing on the file system, resulting in potential data disclosure or local code execution. The weakness is catalogued as CWE‑98.

All releases of the Elated‑Themes Zentrum theme up to and including version 1.0 are affected. No other variants or versions are listed in the available data.

Because the vulnerability has a CVSS base score of 8.1, it is considered high severity. The EPSS score is reported as < 1 %, indicating a very low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The likely attack vector involves an attacker forging a request that supplies a controlled filename to a page that performs the vulnerable include, which requires the attacker to be able to influence a PHP script that accepts such parameters.