The vulnerability is an improper control of filenames used in PHP include/require statements within the Gavias Kunco WordPress theme, which allows PHP Local File Inclusion. This flaw permits an attacker to read arbitrary local files on the server, potentially exposing sensitive configuration, credentials, or code files, thereby compromising confidentiality.

All releases of the Gavias Kunco theme before version 1.4.5 are affected. The issue is fixed in version 1.4.5 and any later releases. Sites currently running any earlier version of the theme are vulnerable.

The CVSS base score of 8.1 indicates a high‑severity flaw. There is no available EPSS score and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no recorded exploitation in the wild. Based on the description, it is inferred that an attacker can supply crafted input through a web request to influence the filename used by the theme's include/require function, thereby achieving file disclosure. The likely attack vector is remote: an attacker can supply crafted input that controls the filename in the include/require statement via web requests. Exploitation requires web access to the affected WordPress installation and can lead to arbitrary file disclosure, which may aid further compromise.