The Freeio theme contains an improper validation of filenames used in PHP include/require statements. This flaw allows an attacker to supply a crafted path that may be included as a local file. Inclusion of arbitrary local files can expose sensitive information or, if the file contains executable PHP code, could enable execution of malicious code on the server. Based on the description, it is inferred that an attacker could gain code execution if a malicious PHP file is included. The vulnerability is categorized as CWE‑98.

All installations of the ApusTheme Freeio WordPress theme with a version number of 1.3.21 or earlier are affected. The issue is applicable to any WordPress site using a vulnerable theme version and does not specify additional platform components.

The CVSS score of 7.5 indicates a high severity flaw, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in CISA's KEV catalog, implying no widely known public exploits. The attack vector presumably involves an HTTP request that injects a path into the vulnerable include logic, and no authentication requirement is stated, so it may be exploitable by unauthenticated users. Because the flaw may lead to remote code execution, the risk to affected sites is significant if exploitation occurs.