An improper control of filename for an include/require statement in PHP enables local file inclusion in the Yozi theme up to version 2.0.63. This flaw allows an attacker who can influence the include path to read arbitrary local files on the web server. By reading files such as wp‑config.php or other sensitive configuration files, the attacker gains access to credentials and site credentials, potentially facilitating further compromise. The vulnerability is mapped to CWE‑98.

The vulnerability affects the ApusTheme Yozi theme for WordPress, specifically any installation using a version from the initial release up to and including 2.0.63. WordPress sites that have this theme active are therefore exposed to the risk described above.

The CVSS score of 8.1 indicates high severity, while the EPSS score of <1% suggests that exploitation is currently rare. The flaw has not been listed in CISA’s KEV catalog. Exploitation would typically involve manipulating a request parameter that feeds into the include/require call; the attacker needs only access to the publicly reachable part of the WordPress installation and must be able to craft the request. Once the inclusion is successful, sensitive local files can be read. Even though the likelihood of immediate exploitation is low, the potential impact is significant.