The vulnerability arises from improper validation of filenames used in PHP include or require statements. An attacker can supply crafted parameters to cause the theme to include local files on the server, potentially exposing sensitive content or enabling further exploitation. This could lead to disclosure of confidential files and, in some scenarios, remote code execution if a malicious file is executed. The weakness corresponds to CWE-98, emphasizing the lack of control over the file being included.

Mikado-Themes "TopFit – Fitness and Gym WordPress Theme" is affected. All releases from the earliest available version up to and including version 1.9 are vulnerable. The issue specifically targets WordPress sites using this theme.

The CVSS score of 8.1 indicates a high severity level, while the EPSS score of less than 1% signals a low likelihood of widespread automated exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been reported as a known, actively exploited vulnerability. The attack vector is likely unauthenticated: a remote attacker can manipulate a URL parameter to trigger the improper file inclusion in a publicly accessible WordPress installation. The impact is limited to the compromised site, but the potential for data disclosure or code execution makes it critical to address promptly.