This vulnerability involves improper control of file names used in PHP include/require statements, leading to a Local File Inclusion flaw. An attacker who can influence the include parameter may be able to force the theme to load arbitrary local files, potentially read sensitive data or inject malicious PHP code. The weakness aligns with CWE-98, which addresses unsafe file operations, and could allow execution of arbitrary PHP code if the attacker supplies a crafted file path.

The vulnerability affects the WordPress Airtifact theme provided by VanKarWai. All releases of the theme from the earliest available versions up through 1.2.91 are impacted. Users deploying these versions should verify their installed theme version and consider upgrading beyond 1.2.91 or removing the theme if an upgrade is not viable.

The CVSS score is 7.5, indicating high severity. The EPSS score is below 1%, implying a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or authenticated, where an attacker can supply a crafted path to a vulnerable include. However, once local file inclusion is achieved, it can be escalated to remote code execution by placing malicious PHP files on the server or reading critical configuration files.