This vulnerability allows a contributor to trigger a local file inclusion, potentially exposing sensitive file contents on the server. The flaw stems from how the Vino theme (version 1.9 or earlier) processes file paths provided by users during certain operations, matching CWE-98. The impact is limited to reading files that the web application can access, which could include configuration or database files if directory traversal is enabled, thereby compromising confidentiality.

The Vino theme from Elated-Themes, any release up to and including version 1.9 on WordPress installations is affected. No specific WordPress core or plugin version is listed, indicating that the issue exists exclusively in the theme files.

The CVSS score of 7.5 marks this as a high‑severity vulnerability. The EPSS score is less than 1 %, suggesting low likelihood of widespread exploitation at present. Because the vulnerability requires contributor‑level access, it is inferred that an attacker must first obtain such privileges, often through social engineering or another vulnerability. Once achieved, the attacker can supply a file path to retrieve arbitrary local files. The flaw is not listed in the CISA KEV catalog, but the nature of local file inclusion makes it a familiar technique used by threat actors.