The Sofass WordPress theme version 1.3.4 and earlier contain an Improper Control of Filename on an Include/Require statement in PHP, which allows attackers to supply arbitrary local file paths through crafted HTTP parameters. The flaw is a Local File Inclusion (LFI) that can expose sensitive configuration files, logs, or any readable file on the web server, and if the included content is executable by PHP, it can lead to Remote Code Execution. The weakness corresponds to CWE‑98.

All installations of the GoalThemes Sofass WordPress theme with a version of 1.3.4 or earlier are affected. The vulnerable code resides in the /wp-content/themes/sofass directory of a WordPress site, and any user who can trigger the include/require logic through external input is at risk.

The CVSS score of 8.1 classifies this issue as high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote HTTP request that sets the include path to a local file; no additional privileges are required beyond access to the web application. Successful exploitation could result in disclosure of confidential data or the execution of malicious code on the server.