The vulnerability arises from an improper control of the filename used in a PHP include/require statement within the ApusTheme Homeo WordPress theme. Attackers can force the application to include arbitrary files, potentially exposing sensitive configuration data or executing injected PHP code. This flaw can lead to full compromise of the site, aligning with CWE‑98.

Any WordPress site that incorporates the Homeo theme version 1.2.59 or older is affected. No other products or platforms are listed.

The flaw enables Local File Inclusion, which can be leveraged for remote code execution if an attacker can supply a path to a PHP file they control. The lack of CVSS or EPSS data does not suggest a low risk, and the potential severity warrants caution. The exploit requires some user interaction or uploaded content, making the risk moderate to high in the absence of a patch.