The vulnerability arises from improper control of filenames in include/require statements within the Victo theme, allowing local file inclusion. Categorized as CWE-98, the flaw lets an attacker manipulate parameters that dictate included files, potentially reading sensitive server files. The resulting impact is data disclosure and the possible compromise of the WordPress site.

The Victo theme from magentech, versions up to and including 1.4.16, is affected. No specific lower bound is provided, so all earlier releases may also be vulnerable.

The CVSS base score of 8.1 signals a high severity, indicating significant confidentiality, integrity, or availability effects. The EPSS score is below 1%, implying a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can trigger the flaw locally by controlling the file path used in include or require statements. Overall risk remains high if the server permits such operations, but real-world exploitation likelihood is currently low.