The Moody theme for WordPress contains a flaw where user input is used directly in PHP include/require statements without proper validation of the file name. This improper control of filenames allows an attacker to manipulate the include path and request arbitrary files on the server, potentially leading to sensitive data disclosure or, if an attacker can inject executable code, remote code execution. The weakness is classified as CWE-98.

ThemeMove’s Moody theme running on WordPress installations is affected. All versions up to and including 2.7.3 are vulnerable; higher numbered releases are not impacted as they have removed the insecure include logic.

The CVSS score of 8.1 indicates a high severity of this local file inclusion flaw. The EPSS score is under 1 %, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is benign, such as a crafted request that passes a specially crafted file path to the theme’s PHP code. If an attacker can place malicious content under a directory the theme can read, or if the include points to a scriptable file, the impact could extend to full remote code execution. Administrators should treat this as a high‑risk issue requiring timely patching.