The vulnerability is an improper control of the filename used in PHP include/require statements within the WordPress Good Homes theme, allowing attackers to perform local file inclusion. This flaw can expose sensitive configuration files, user data, or other internal information, and in the worst case may enable the execution of arbitrary PHP code if a malicious file is read and interpreted. The issue is categorized as CWE-98 and has a CVSS score of 8.1, indicating a high severity attack that could compromise confidentiality, integrity, or availability of the affected website.

The affected product is the Good Homes WordPress theme from ThemeREX. Any installation of Good Homes theme version 1.3.13 or earlier is vulnerable, including sites that have not yet applied the latest updates. Users of older versions should review their theme version and upgrade immediately if possible.

The CVSS score of 8.1 signals a significant risk, but the EPSS score of less than 1% suggests that exploitation is uncommon at present. The vulnerability is not listed in the CISA KeV catalog, implying no known active exploitation campaigns. Based on the description, it is inferred that an attacker would craft a request that manipulates the file path in an include/require call, gaining read access to local files or triggering execution of arbitrary PHP code. The exact attack vector is not directly detailed, but the nature of the flaw points to a reflected or file path manipulation vector.