Improper control of the filename used in PHP include/require statements in the snstheme Avaz WordPress theme creates a local file inclusion (LFI) flaw. An attacker can manipulate input to cause the theme to include arbitrary files on the web server, potentially exposing sensitive data or even executing code if the included file is PHP and contains malicious content. This weakness corresponds to CWE‑98 and can impact the confidentiality and integrity of the affected WordPress installation.

The vulnerability affects the snstheme Avaz theme for WordPress from the earliest release through version 2.8. Any WordPress site that installs or continues to use Avaz up to and including 2.8 is at risk.

The CVSS score of 8.1 indicates a high severity vulnerability with a moderate to high exploitability. The EPSS score of less than 1% suggests that the probability of exploitation in the wild is low, but that does not eliminate the risk. The flaw is not currently listed in the CISA KEV catalog. Exploitation would most likely occur via a web request that controls the filename passed to an include or require statement; the attacker does not need prior authentication and can target publicly accessible URLs that use the theme’s parameters.