The WordPress Alchemists theme contains an improper validation of the filename used in PHP include/require statements, leading to a Local File Inclusion vulnerability identified as CWE‑98. An attacker can manipulate the input that determines the file path and force the application to include a local file. Based on the description, it is inferred that if the attacker can supply a malicious PHP script as the included file, the vulnerability could potentially lead to remote code execution.

WordPress installations that employ the Alchemists theme version 4.6.0 or earlier, distributed by developer dan_fisher. No further version granularity is specified beyond the stated upper bound.

The base CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability that the flaw is currently being exploited, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local to the web application, requiring an attacker to influence a request parameter that controls the include path. Because the flaw permits inclusion of arbitrary local files, there is a realistic possibility of remote code execution should a PHP file be injected or already exist on the system.