The Printy theme contains a PHP include/require statement whose filename is derived from user input without proper validation. This flaw permits an attacker to supply arbitrary local file paths, enabling the reading of any file accessible to the web server. If the chosen file contains PHP code, the included script may be executed, potentially allowing an attacker to run code on the server. The possibility of code execution is inferred from the nature of PHP's include mechanism and is not explicitly stated in the official description.

Any WordPress site that has the ThemeREX:Printy theme installed in a version from the earliest available release through 1.8 is vulnerable. Site owners should verify whether the Printy theme is active and determine the exact version in use.

The vulnerability has a CVSS base score of 8.1, reflecting high severity. Its EPSS score of less than 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthorized URL that manipulates the include filename supplied by the theme; a remote attacker could trigger this from the internet. Given the high CVSS and the potential for file disclosure or code execution, the risk remains significant for sites that have not addressed the flaw.