The Yottis WordPress theme contains a flaw that allows an attacker to include arbitrary files on the server through PHP’s include/require mechanisms. This improper control of the filename is a classic Local File Inclusion vulnerability, represented by CWE‑98, and can enable the disclosure of sensitive configuration files, credentials, or other protected data. The impact is primarily confidentiality loss and potential escalation of privileges if the included files are executed with elevated permissions.

WordPress installations that use the ThemeREX Yottis theme, any version up to and including 1.0.10. Based on the description, it is inferred that all older releases prior to 1.0.10 are potentially affected as well.

With a CVSS score of 8.1, this vulnerability is considered high severity, though its EPSS score is less than 1 %, indicating a low likelihood of active exploitation at present. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote depending on how the theme processes file path parameters; the description suggests that unsanitized inputs can be controlled by a user, thereby making the vulnerability exploitable through crafted requests.