The Amoli WordPress theme contains an improper control of the filename used in a PHP include or require statement. This flaw enables an attacker to include any local file on the server. If the included file contains executable PHP code, the attacker may run arbitrary code, compromising the confidentiality, integrity, and availability of the site.

The vulnerability affects the Amoli theme by Elated-Themes. Every release of the theme up to and including version 1.0 is susceptible. No later versions are affected as the issue was fixed after 1.0.

The CVSS score of 8.1 marks this as a high-severity flaw. The EPSS score is below 1%, indicating a low but present likelihood of exploitation. It is not listed in CISA's KEV catalog. The likely attack vector is a web request that supplies a URL parameter or form input leading to the vulnerable include. Based on the description, it is inferred that remote code execution is possible if the attacker supplies a malicious PHP file for inclusion, though this requires the attacker to control the file contents.