The Trendustry theme for WordPress contains an error in handling filenames used by PHP include/require statements, allowing a malicious user to influence the path that the theme loads. This flaw enables Local File Inclusion and, depending on the server configuration, the execution of arbitrary code. The weakness is classified as an improper control of filename (CWE‑98).

All installations using CreativeWS Trendustry theme versions up to and including 1.1.4 are affected. Sites running any of these releases can potentially allow a user to supply a file path that the theme will include.

The vulnerability scores 8.1 on the CVSS scale, indicating high severity, but its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting a low immediate exploitation likelihood. Based on the description, it is inferred that the attack vector is a crafted request, such as a URL or form input, containing a malicious file path. No authentication is required, and successful exploitation could grant an attacker the ability to read sensitive files or execute code, potentially giving full control over the affected WordPress site.