Improper control of filenames in the include/require statements of the Ogami theme allows an attacker to perform PHP local file inclusion, enabling read of arbitrary files on the webserver and possibly execution of malicious code depending on the included content. The weakness is classified as CWE‑98 and carries a CVSS score of 8.1, indicating a high‑severity vulnerability.

All installations of the ApusTheme Ogami WordPress theme with a version number of 1.53 or earlier are impacted. The vulnerability applies from the earliest released version (n/a) through version 1.53 inclusive.

The exploit can be performed from the public web interface, assuming the theme’s vulnerable include routine accepts user‑controlled input. The attack vector is likely through crafted URLs or form inputs that manipulate the path sent to the include/require function. Although the EPSS score is below 1%, indicating a low probability of exploitation in the wild thus far, the high CVSS score and the lack of a KEV listing mean that careful monitoring and rapid mitigation are advised. No additional prerequisites are publicly documented, but successful exploitation requires that the attacker can send a request to the vulnerable script.