The Flow theme for WordPress contains an uncontrolled filename passed to a PHP include/require statement, a weakness classified as CWE-98. This flaw permits an attacker to read arbitrary files on the local filesystem, and if a PHP file is included it can execute code on the server. The vulnerability carries a CVSS score of 7.5, indicating a high severity with significant risk to confidentiality, integrity, and availability of the affected site.

WordPress installations that use the Elated‑Themes Flow theme version 1.8 or earlier are vulnerable, regardless of the host’s environment or PHP configuration.

The EPSS score is less than 1 %, suggesting a very low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the exploit remotely by manipulating request parameters to supply a malicious file path to the include statement. Successful exploitation would allow read access to any local file and, if a PHP file is included, could lead to arbitrary code execution, posing a serious threat to the website’s security.