The vulnerability stems from an improper control of the filename used in an include or require statement within the Gioia theme. This flaw enables loading of unintended local files, potentially exposing sensitive configuration data or executing arbitrary PHP code if a crafted file is included. The resulting compromise could lead to disclosure of confidential information or a full compromise of the website if remote code execution becomes possible through the included file.

The vulnerability impacts the Elated‑Themes Gioia WordPress theme at all versions up to and including 1.4. Any WordPress installation that still uses a Gioia theme version 1.4 or earlier is potentially exposed.

The CVSS score of 8.1 indicates a high risk to confidentiality, integrity, and availability. The EPSS score of less than 1% suggests current exploitation rates are low, and the issue is not listed in the CISA KEV catalog. The attack vector is likely local file inclusion, as indicated by the description, but the specific required conditions are not explicitly stated and are inferred from standard LFI behavior.