The vulnerability allows the inclusion of local files via an improper control of the filename used in PHP include or require statements. This flaw can lead to the disclosure of sensitive server files or, in some configurations, the execution of arbitrary PHP code, thus compromising the confidentiality, integrity, or availability of the affected WordPress site. The weakness is formally classified as CWE‑98.

WordPress sites that use the Mikado‑Themes Amfissa theme version 1.1 or earlier are affected. No other product versions are listed, meaning the risk applies to installations that have not yet upgraded beyond the stated cutoff.

The CVSS score of 8.1 indicates a high severity, and the EPSS score of less than 1% suggests that public exploit code is currently rare. The issue is not recorded in the CISA KEV catalog. Likely attackers would craft a request that passes a path parameter to the vulnerable inclusion point, enabling them to read local files or trigger PHP execution when the server’s configuration permits it. Exploitation requires the attacker to reach the WordPress instance via HTTP, so network-level or web application defenses can mitigate the attack vector.