The vulnerability is an improper control of filename for include/require statements in the WordPress Kratz theme, allowing a local file inclusion attack. An attacker who can influence the filename parameter can cause PHP to read or execute files on the server, leading to information disclosure or remote code execution.

WordPress sites that use the ThemeREX Kratz theme version 1.0.12 or earlier are affected. Any instance of this theme on a live site potentially exposes the vulnerability.

The CVSS score of 8.1 marks it as high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, leveraging crafted URLs or form inputs that provide a filename to the vulnerable include statement. Successful exploitation would grant an attacker read access to arbitrary server files and potentially allow execution of malicious code if the included file contains executable PHP.