The VintWood theme for WordPress contains a flaw where the filename used in a PHP include or require statement is not properly sanitized, allowing an attacker to cause PHP to include arbitrary local files during script execution. The likely attack vector is through crafted HTTP requests that supply a filename value to the vulnerable code, which is not shown in the official description but follows common LFI vectors. Reading local files can expose sensitive configuration or data and, if the included content can execute code, may lead to further compromise, although that outcome is an inference rather than an explicit claim in the CVE entry.

CreativeWS VintWood theme versions up to and including 1.1.8 deployed on any WordPress site are affected. The vulnerability relates solely to the theme’s PHP files; WordPress core and other plugins are not directly impacted by this issue.

The CVSS base score of 8.1 signals a high overall risk. The EPSS score of less than 1% indicates a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. It is likely exploitable by sending a manipulated HTTP request to the affected theme script, requiring web application access. The potential impact is limited to the affected WordPress site unless additional weaknesses exist.