This vulnerability arises from improper control of filenames used in PHP include/require statements within the Brook theme, allowing the inclusion of arbitrary local files during page rendering. The flaw corresponds to CWE‑98, which concerns insecure handling of filenames in inclusion functions. Based on the description, it is inferred that the included file could contain executable code and, therefore, may lead to remote code execution if the environment permits.

The Brook theme supplied by ThemeMove is affected in all releases up to and including version 2.9.0. Users running any of these versions on a WordPress site are potentially susceptible.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% indicates a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is via a publicly exposed URL parameter or form field that influences the include path. The required prerequisites are typically a functional WordPress installation with the Brook theme active and the vulnerable include logic reachable from the web.