The vulnerability permits an unauthenticated attacker to include arbitrary files from the local filesystem on WordPress sites that use the Armania theme 1.4.8 or earlier. The file inclusion logic accepts user‑supplied paths without proper validation, a classic example of CWE‑98. An attacker could request a path that points to a sensitive file within the WordPress installation, potentially exposing configuration information or other secrets and resulting in information disclosure.

WordPress installations running the Armania theme from kutethemes with a version of 1.4.8 or older are affected. Site owners who have upgraded beyond that version are not at risk.

The CVSS score of 8.1 places this issue in the high‑severity category, and because it is unauthenticated, it is exploitable by any web visitor. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploits at the time of assessment. The likely attack path involves triggering the theme's file inclusion routine with a crafted request that supplies an arbitrary file path.