The Lella WordPress theme contains improper control of filenames used in PHP include and require statements, which can lead to a Local File Inclusion flaw. An attacker can cause the theme to read arbitrary files from the server, and if the included file contains PHP code, it may execute that code in the context of the site. This defect aligns with CWE‑98 and can compromise the confidentiality of server files, potentially enabling further code execution.

Any WordPress installation that uses the Elated‑Themes Lella theme version 1.2 or earlier is affected. The issue exists from the initial release through all updates that do not exceed 1.2 and applies to sites where the theme is active or its files are accessible.

The CVSS base score of 8.1 indicates high severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. Based on the description, it is inferred that an unauthenticated attacker could trigger the inclusion of arbitrary local files via a crafted URL or form parameter. The flaw is not listed in the CISA KEV catalog, and no special privileges beyond the presence of the vulnerable theme are required. If the attacker can force the inclusion of a PHP file, privilege escalation within WordPress could be achieved.