The flaw originates from improper control of filenames used in PHP include/require statements within the TieLabs Jannah theme, allowing an attacker to trigger PHP Local File Inclusion. By manipulating the filename parameter, an adversary can include arbitrary local files on the server, potentially exposing sensitive configuration data, credentials, or providing a foothold for further exploitation such as code execution. This vulnerability corresponds to CWE‑98: Improper Control of Filename for Include/Require Statement.

The TieLabs Jannah theme for WordPress is affected. All releases from the initial launch up through version 7.6.4 contain the flaw. WordPress sites that have installed any of these theme versions are at risk; no other vendors or products are listed.

The CVSS score of 8.1 indicates high severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The CVE is not part of the CISA KEV catalog. The likely attack vector is via the web interface where the theme is active, by sending crafted HTTP requests that trigger the vulnerable include. Based on the description, it is inferred that authentication is not required for the inclusion, meaning unauthenticated or low‑privilege users could potentially succeed, with the ultimate impact depending on file system permissions and web server configuration.