The flaw stems from insufficient validation of filenames used in PHP include or require statements within the Elated‑Themes FindAll theme. An attacker who can manipulate the filename parameter may trigger the inclusion of arbitrary local files on the web server. This can expose sensitive configuration, credential, or code files. While the vulnerability is classified as a local file inclusion, it could potentially lead to arbitrary PHP code execution if a writable file containing malicious code is included. The weakness is identified as CWE‑98.

All releases of the Elated‑Themes FindAll WordPress theme up to and including version 1.4 are affected. No other vendors or product lines are listed in the CVE data.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation attempts were rare at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a web request that manipulates the filename used in the theme’s include logic, because the description references PHP include/require statements. An attacker would need to supply a crafted request that causes the theme to include a local file, which could reveal sensitive data or, if a malicious file is included, lead to remote code execution. The low EPSS probability does not negate the severity of the potential impact.