This vulnerability stems from improper validation of filenames used in PHP include/require statements within the Elated‑Themes Laurent WordPress theme. An attacker who can influence the filename supplied to the include mechanism may cause arbitrary local files to be read or executed, potentially exposing sensitive data or achieving remote code execution. The flaw is classified as CWE‑98, Local File Inclusion.

WordPress sites that use the Elated‑Themes Laurent theme versions 3.1 or earlier are affected. These versions— from the earliest release up to 3.1—contain the vulnerable include logic.

The CVSS score for this issue is 7.5, indicating moderate to high severity, while the EPSS value of less than 1% suggests a very low exploitation probability at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which reduces the likelihood of a widespread pre‑existing exploit. The most likely attack vector is a remote attacker abusing a publicly exposed PHP page that accepts a filename parameter, but the specific vector is inferred from the nature of the flaw.