The vulnerability stems from improper control of the filename used in PHP include/require statements, allowing an attacker to influence the path and trigger a local file inclusion. If successful, this flaw could enable the disclosure of sensitive files or execution of arbitrary code, potentially compromising the entire WordPress site or allowing privilege escalation. The weakness is classified as CWE‑98.

Elated‑Themes Etchy theme versions up to and including 1.0 are affected. No higher versions are listed as vulnerable.

The CVSS score of 8.1 indicates a high severity for this vulnerability. The EPSS score of less than 1% suggests a low current probability of exploitation, and the issue is not listed in the CISA KEV catalogue. The likely attack vector is inferred to be web-based, where an attacker crafts a request that manipulates the file path used by the theme for internal includes. Successful exploitation would require access to the theme’s configuration or overrideable parameters, but the potential impact is significant due to the possibility of executing attacker-supplied code.