The vulnerability arises from improper validation of filenames used in PHP include or require statements within the Tripgo theme. This flaw permits an attacker to supply arbitrary filenames, potentially exposing local file contents or executing arbitrary code. The weakness is classified as a Local File Inclusion vulnerability and is mapped to CWE-98.

All deployments of the ovatheme Tripgo WordPress theme running any version prior to 1.5.6 are affected. This includes every available release from the earliest version up to but not including v1.5.6.

The EPSS score indicates an exploitation likelihood of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of active exploitation. The description implies that an attacker would need to supply a malicious filename through a user‑controllable variable that reaches the theme’s include logic, likely via a crafted front‑end request or input form. While no public exploits have been documented, the potential for file disclosure or remote code execution warrants timely remediation.