The Rosebud theme uses an include/require statement that is not properly validated, enabling an attacker to influence the file that PHP loads. This flaw can lead to the inclusion of arbitrary local files on the server, potentially exposing sensitive configuration files or other data stored within the theme. The vulnerability description does not state that the included file is executed as code, so the primary risk is data disclosure through Local File Inclusion.

All versions of the Mikado Themes Rosebud theme up to and including 1.4 are affected. WordPress sites that have any of these releases installed are at risk, regardless of other plugins or host settings, because the flaw resides in the theme itself.

The CVSS score of 8.1 reflects high potential impact, while the EPSS score is reported to be below 1 %, indicating low likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Attackers will likely need to craft a request that manipulates the include path to point to a local file; this inference is based on the description of local file inclusion.