The vulnerability arises from improper control of filenames used in PHP include/require statements within the Aora theme, enabling attackers to specify arbitrary local files to be parsed by the server. This flaw can be exploited to read sensitive system files or, if the attacker can influence the inclusion of a PHP payload, execute arbitrary code on the affected machine.

WordPress installations that use the Aora theme from thembay, versions 1.3.15 and earlier, are impacted. The flaw resides in the theme’s file inclusion logic and applies across all editions of the affected releases.

The CVSS score of 8.1 signals a high severity, while the EPSS value of less than 1% indicates a relatively low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit the flaw by sending crafted requests that trigger the vulnerable include path, potentially via an exposed URL parameter. It is also inferred that no special privileges beyond normal web access to the site would be needed, but if the attacker can control the included file, full code execution could result.