The vulnerability stems from improper control of the filename used in a PHP include/require statement within the Struktur Core plugin. This flaw allows an attacker to trigger a local file inclusion, potentially reading sensitive files or executing arbitrary server‑side code. The description references a PHP Remote File Inclusion scenario, suggesting that remote input could be used to induce inclusion, but the only confirmed effect is local file inclusion. The weakness is classified as CWE‑98, indicating unsafe input handling in the path resolution process.

Affected systems are WordPress sites running Select–Themes: Struktur Core up to, but not including, version 2.7. The plugin in those versions contains an LFI issue. No specific WordPress core or server environment is mentioned in the advisory, so any WordPress installation that includes the vulnerable plugin is at risk.

The CVSS base score is 7.5, reflecting a less than 1% EPSS score, indicating that current exploit activity is rare. The vulnerability is not listed in CISA’s KEV catalogue, indicating no known large‑scale exploitation. Exploitation would likely come from the plugin processing unsanitized user input, leading to LFI. While the description alludes to remote file inclusion possibilities, the confirmed impact is LFI. The attack vector is inferred from the nature of the flaw; no explicit vector information is supplied in the advisory.