The flaw arises from improper control over the filename used in PHP include/require statements, allowing an attacker to direct the application to include arbitrary local files. This Local File Inclusion vulnerability, identified as CWE‑98, could lead to the disclosure of sensitive configuration files, logs, or code, and in some cases to remote code execution if the attacker can supply a malicious file.

The issue affects WordPress sites that use the Elated‑Themes Roisin theme version 1.2.1 or earlier. Any installation running a vulnerable version of this theme is impacted.

The CVSS score of 8.1 denotes high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is web requests that supply a crafted filename to the theme’s code; this inference assumes the application accepts user-supplied input for the include path and that the attacker can manipulate it.