The vulnerability is an improper control of filenames in PHP include/require statements, categorized as a Local File Inclusion (CWE‑98). An attacker can supply crafted input that causes the Edifice theme to include arbitrary local files, potentially exposing sensitive configuration data or executing attacker‑supplied PHP code. This allows a privileged attacker or one with basic web access to read or run files on the server, leading to confidentiality and integrity violations and possibly full remote code execution.

The flaw affects the WordPress theme authored by ThemeREX, named Edifice, in all releases through version 1.8. Users who have not upgraded beyond 1.8 are susceptible.

The CVSS score of 8.1 reflects a high severity vulnerability that can be triggered by remote attackers via the web interface when the Edifice theme is active (inferred). The EPSS value is below 1%, indicating a very low current exploit probability, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. While the likelihood of exploitation remains low, the potential impact—local file read, possibly leading to remote code execution—justifies prompt remediation.