This vulnerability arises from improper validation of filenames used in PHP include/require statements within the Valen theme, allowing attackers to trigger Local File Inclusion. An attacker can use crafted requests to read arbitrary files on the server, potentially exposing configuration, credentials, or other sensitive data. The flaw is rated CVSS 8.1, indicating high risk, and remains a significant threat in WordPress sites that have not patched the theme.

This flaw affects the Valen – Sport, Fashion WooCommerce WordPress Theme from snstheme, in all releases up to and including version 2.4. Sites running any of these versions are vulnerable, including older custom installations that may not have applied the theme update.

The CVSS of 8.1 reflects its high severity, but the EPSS score of less than 1% suggests that exploitation is currently rare. Nonetheless, the vulnerability is reachable via the publicly accessible web interface; a remote attacker only needs to supply a manipulated parameter that is passed to an include function. Once exploited, the attacker can read sensitive files and could potentially pivot to compromise the entire WordPress site if additional weaknesses exist. The theme is not listed in CISA’s KEV catalog, but it is advisable to treat it as a moderate-to-high risk due to the potential data exposure.