The vulnerability arises from improper validation of filenames used in a PHP include/require statement within the Greenly WordPress theme. The CVE description states that this flaw allows PHP Local File Inclusion, which is identified as CWE-98. Local file inclusion can enable an attacker to read or execute arbitrary files on the web server, potentially leading to the execution of malicious code, compromise of confidential data, or service disruption.

The issue impacts the Creatives_Planet Greenly theme for WordPress for all releases up to and including version 8.1. No specific patch or later versions are listed, so any deployment using the theme version 8.1 or earlier is considered vulnerable. The affected CPEs are not provided; the vendor and product identifiers are Creatives_Planet:Greenly.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector would involve manipulating a local filename parameter within the theme’s PHP code. It is inferred that an attacker could supply a crafted filename to include arbitrary local files, potentially leading to exploitation. The description does not explicitly state the method of exploitation, so this inference is based on the nature of the vulnerability described.