The vulnerability originates from insecure handling of filenames in PHP include/require statements within the ApusTheme Freeio theme. The flaw enables an attacker to include arbitrary local files on the server, which could expose configuration data, credentials, or allow execution of PHP code if a malicious file is placed in a writable directory. This weakness is classified as CWE‑98.

WordPress sites that use the ApusTheme Freeio theme version 1.3.21 or earlier are affected. The issue applies to all releases up to and including 1.3.21, as indicated by the vendor, so any installation running a version in that range is vulnerable.

The risk is moderate to high because local file inclusion can reveal sensitive data or enable code execution. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can supply a crafted file path in a URL parameter or form input, making the attack vector remote. Administrators should treat this flaw as critical until a fixed theme version is released or an effective workaround is applied.