The Premium Portfolio Features for Phlox theme plugin contains a local file inclusion flaw in the args[extra_template_path] parameter. An unauthenticated attacker can supply an arbitrary path to a PHP file, causing the server to include and execute that file. This enables the attacker to bypass access controls, read sensitive data, or run arbitrary PHP code, effectively compromising the affected WordPress installation.

WordPress sites using averta’s Premium Portfolio Features for Phlox theme plugin, version 2.3.10 or earlier, remain vulnerable. Sites that have not upgraded beyond these versions are at risk.

The CVSS score of 8.1 reflects the high impact of remote code execution, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in CISA KEV, but it can be exploited through a simple HTTP request containing the malicious args[extra_template_path] value. An attacker does not need authentication but must have internet access to the site and the ability to reference a PHP file—either from the local filesystem or an uploaded one that can be included.