The vulnerability arises from improper control of the filename used in a PHP include/require statement within the Struktur Core plugin. This flaw permits an attacker to trigger a local file inclusion, potentially reading sensitive files or executing arbitrary server‑side code if the application environment allows. The weakness is identified as CWE‑98, indicating unsafe input handling in the path resolution process.

Affected systems are WordPress sites running Select‑Themes: Struktur Core up to and including version 2.5.1. The plugin in those versions contains an LFI issue. No specific WordPress core or server environment is mentioned in the advisory, so any WordPress installation that includes the vulnerable plugin is at risk.

The CVSS base score is 7.5, reflecting a less than 1% EPSS score, indicating that current exploit activity is rare. The vulnerability is not listed in CISA’s KEV catalogue, indicating no known large‑scale exploitation. Exploitation would likely come from the plugin processing unsanitized user input, leading to LFI. The attack vector is inferred from the nature of the flaw; no explicit vector information is supplied in the advisory.