The Aqua theme for WordPress contains a flaw where the filename used in an include/require statement is not properly sanitized, allowing the inclusion of arbitrary local files. This Improper Control of Filename vulnerability (CWE‑98) can lead to the disclosure of configuration data or the execution of malicious code if an attacker can supply a path to a malicious script. Based on the description, it is inferred that an attacker could potentially read sensitive files or execute code through the vulnerable include mechanism, though the exact outcomes depend on the server configuration.

All releases of the Aqua theme provided by jwsthemes up to and including version 5.1.2 are affected. No patched or updated release is indicated in the data, so sites still running these versions remain vulnerable until a fix is applied.

The CVSS score of 7.5 indicates a high severity of the flaw. The EPSS score of less than 1 percent suggests a low likelihood of current exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the flaw can be triggered by an unauthenticated web request that manipulates the include path, so an attacker does not need privileged access to the server. Consequently, the threat remains significant to the confidentiality, integrity, and availability of the affected WordPress sites.