The vulnerability exists in PHP code of the WordPress Emphires theme, where an attacker can manipulate the filename used in an include or require statement to load an arbitrary local file. This allows the attacker to read sensitive files or execute arbitrary PHP code, potentially compromising the confidentiality, integrity, and availability of the impacted website. The weakness corresponds to improper control of filename for include/require.

WordPress installations that use the Creatives Planet Emphires theme version 3.9 or earlier are affected. The issue impacts all sites that have retained older theme releases that have not been updated.

The CVSS score of 7.5 indicates a high risk, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local via manipulated application input that triggers the include. An attacker with access to the website’s file inclusion mechanism could exploit this flaw without needing privileged credentials.