The vulnerability allows an attacker to trigger a local file inclusion in the Edge‑Themes Aalto WordPress theme when a site runs version 1.8 or earlier. This flaw is unauthenticated, meaning that no user credential is required to exploit it. Based on the definition of local file inclusion, it is inferred that an attacker could read any file accessible to the web server, potentially exposing configuration data or other sensitive information. The weakness is categorized as CWE‑98, which reflects an improper validation of a file path that can be manipulated by an attacker.

WordPress sites that use the Edge‑Themes Aalto theme version 1.8 or earlier are affected. No other vendors or products are mentioned.

The CVSS score of 8.1 places this flaw in the high severity range. Exploitation does not require authentication and can be performed through the normal public web interface, making it readily available to any attacker with network access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high rating indicates a significant risk to sites that continue to run the vulnerable theme version.