The Petito WordPress theme contains a flaw that lets attackers control the filename used in a PHP include/require statement. This lack of proper input validation allows the inclusion of arbitrary local files, which can lead to disclosure of sensitive files or execution of malicious code if a PHP file is included. The issue is cataloged as CWE‑98, describing uncontrolled inclusion vulnerabilities.

BZOTheme Petito releases prior to 1.6.6 are affected. Any installation of Petito version 1.6.5 or earlier remains vulnerable until updated.

The CVSS score of 8.1 classifies this vulnerability as high severity, indicating that successful exploitation could provide significant access or control over the affected site. The EPSS score is below 1%, indicating a very low current probability of exploitation in the wild, though the risk persists for users with vulnerable installations. There is no listing in CISA’s KEV catalog. An attacker would typically craft a request that points the insecure include/require to a chosen local path; if the path resolves to a PHP source file or a file that the application can interpret as code, the attacker can execute arbitrary PHP, effectively taking control of the application.