The vulnerability arises from an improper control of the filename in a PHP include/require statement within the Askka theme. An attacker could supply a crafted filename to cause the theme to include unintended files on the server, leading to reading sensitive configuration files or executing arbitrary PHP code if the attacker can supply a PHP file. This weakness corresponds to CWE-98, which can enable remote code execution or data disclosure.

Affected installations are those running Elated‑Themes Askka theme version 1.0 or earlier. The issue impacts all websites that have installed the theme during its life cycle up to version 1.0, regardless of other configurations. No specific version identifier beyond <= 1.0 is provided.

The vulnerability carries a CVSS score of 8.1, classifying it as high severity. However, the EPSS score indicates a very low probability of exploitation. It is not listed in the KEV catalog, suggesting no widespread exploitation has been reported. Based on the description, the likely attack vector involves local file inclusion via crafted requests, potentially allowing remote code execution. The risk is driven by the high severity and the severe consequences of arbitrary code execution, although the low EPSS suggests a comparatively lower likelihood of exploitation in the wild.