The vulnerability stems from improper control of a filename in a PHP include/require statement within the Belfort theme, allowing local file inclusion. By exploiting this flaw, an attacker can read or execute arbitrary files on the server, potentially leading to remote code execution and total compromise of the WordPress site.

WordPress installations that use the Belfort theme from its initial release through version 1.0 are affected.

The CVSS score of 8.1 indicates a high severity risk. An EPSS score of less than 1% shows a low probability of current exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is either unauthenticated or requires minimal privileges, leveraging the theme’s include logic. An attacker would need to manipulate a request that triggers the vulnerable include to read or execute files.