The vulnerability arises from inadequate control over the filename supplied to PHP include/require statements in the WordPress Green Thumb theme. This flaw permits the attacker to force the inclusion of arbitrary local files, enabling reading of sensitive files or execution of malicious PHP code residing on the site's filesystem. Consequently, an exploited site could suffer unauthorized disclosure of configuration information, user credentials, or full remote code execution if the attacker supplies a PHP script to be included.

The issue affects the Green Thumb theme supplied by ThemeREX, all versions up through and including 1.1.12. Any WordPress site that has installed these versions of the theme is vulnerable to the LFI flaw.

The flaw carries a CVSS score of 8.1, reflecting high severity. Its EPSS score is reported as less than 1%, suggesting a low likelihood of active exploitation at present, and it is not listed in the CISA KEV catalog. The most likely attack vector involves unauthenticated web requests that supply malicious input to influence the include path, although documented exploitation evidence is not provided in the description.