Improper control of a filename in a PHP include/require statement allows a Local File Inclusion (LFI) flaw. The flaw appears in the Select‑Themes Prowess WordPress theme up to version 1.8.1. An attacker who can influence the include path can read sensitive files on the web server, and if arbitrary code execution is possible, execute code, leading to confidentiality or integrity breaches. The vulnerability is categorized as CWE‑98.

The issue is present only in the WordPress Prowess theme by Select‑Themes. All releases with a major or minor version of 1.8.1 or earlier are affected; no subsequent releases are noted as vulnerable.

The CVSS base score of 8.1 indicates a high severity with a medium–high exploitation risk. The EPSS value of <1% suggests limited current exploitation in the wild, yet the flaw remains a viable target for prepared adversaries. The attack vector is not explicitly described, but it is inferred that a crafted HTTP request manipulating the include parameter can trigger the LFI. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation to date.