The vulnerability is an improper control of a filename used in a PHP include/require statement in the BZOTheme CraftXtore WordPress theme, allowing local file inclusion. An attacker who can influence the filename parameter could read arbitrary files from the server and may be able to execute local PHP code if the included file contains executable scripts. This weakness is formally identified as CWE‑98.

WordPress sites that use the BZOTheme CraftXtore theme, versions n/a through 1.7 inclusive. Any installation running CraftXtore v1.7 or earlier is susceptible; newer versions are not affected.

The shared CVSS score is 8.1, indicating high severity. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can control the filename used in the include statement, which can occur via reflected input in the theme’s URL parameters or template files. Once the attacker supplies an arbitrary path to a local file, the theme will include that file, potentially revealing sensitive content or executing malicious code.