Improper control of filenames used in PHP include/require statements in the PrintXtore theme permits local file inclusion. An attacker can supply crafted input that directs the PHP interpreter to include arbitrary files from the server’s filesystem, potentially exposing sensitive configuration files or enabling the execution of malicious code. This weakness leads to a compromise of the application’s integrity and may allow further exploitation such as remote code execution if the included files contain executable code.

The vulnerability exists in the WordPress PrintXtore theme supplied by BZOTheme for all versions below 1.7.8. WordPress installations that have this theme installed and have not applied patch version 1.7.8 or later are affected.

The CVSS v3 base score of 8.1 classifies this as a high‑severity flaw. The EPSS score of less than 1% indicates that the exploit probability is very low, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is a publicly accessible WordPress site where an attacker can inject a malicious filename into a request that triggers the theme’s inclusion logic. While the reported impact is local file inclusion, the potential for subsequent code execution makes the risk significant for administrators of affected installations.