The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, allowing an attacker to perform Local File Inclusion on WordPress sites using the ThemetechMount Boldman theme version 7.7 or earlier. This flaw can enable the attacker to read sensitive files or, if the server configuration permits, execute arbitrary code by including malicious files. The weakness corresponds to CWE‑98.

This issue affects the WordPress Boldman theme produced by ThemetechMount. Any site running Boldman from its earliest release through version 7.7 is vulnerable. Any newer version is not affected per the vendor data.

The CVSS base score is 7.5, indicating moderate to high risk. The EPSS score is below 1 %, suggesting a low probability of exploitation in current threat data. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely trigger the flaw by supplying crafted input that exploits the include/require mechanism in the theme's PHP code; however, the exact attack vector is not defined in the vendor description and would require further analysis of the theme's file handling logic.