Improper control of the filename used in PHP's include/require statements in the Brook theme enables a local file inclusion vulnerability. An attacker could supply a crafted input that causes the theme to include an arbitrary file on the server, potentially exposing sensitive configuration, database credentials, or other confidential data. Depending on the context, this LFI flaw could also allow execution of arbitrary PHP code, leading to full compromise of the WordPress site. The weakness is identified as CWE‑98.

The Brook WordPress theme from ThemeMove, version 2.9.0 and earlier, is affected. Users running any installation of the theme with these or older releases are susceptible until the issue is patched.

With a CVSS score of 8.1, the vulnerability is considered high severity, but the EPSS score of less than 1% suggests that successful exploitation is unlikely in the wild at present. The flaw is not listed in the CISA KEV catalog. Exploitation would probably involve manipulating a user‑controlled parameter that the theme uses to build the include path, such as a GET or POST value. No known public exploits have been reported, and mitigations are available through a patch or by restricting the inclusion logic.