The vulnerability arises from improper control of filenames used in PHP include/require statements, allowing an attacker to trigger the application to locally include arbitrary files. This can lead to disclosure of sensitive files such as configuration or user data, and in some scenarios may enable execution of malicious code if an attacker can influence the path to a payload. The weakness corresponds to CWE‑98.

LaunchandSell's Tribe WordPress theme, versions up to and including 1.7.3, is affected.

The CVSS score is 8.1, indicating high severity, while the EPSS score is less than 1 %, suggesting a low likelihood of exploitation at present; the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an attacker to trigger the vulnerable include with a crafted file path via exposed query parameters or inputs that influence the filename; once exploited, the attacker could read sensitive files and potentially achieve code execution if file upload or payload delivery is possible.