The Healsoul WordPress theme contains an improperly controlled filename for an include/require statement in PHP. This flaw allows a local file inclusion (LFI) vector to be exploited, potentially exposing sensitive files or executing arbitrary code on the affected server. The reported weakness is classified as CWE-98. The impact is that an attacker who can influence the include path may read local files or gain further compromise of the web application.

The vulnerability affects the ThemeMove Healsoul WordPress theme, versions up to and including 2.2.3. Any WordPress site that has this theme installed and has not updated beyond v2.2.3 is at risk. Owners of older WordPress installations that rely on this theme should verify their version and apply vendor updates accordingly.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1 % suggests that, as of the latest data, exploitation is considered unlikely. The vulnerability appears to be exploitable via a local file inclusion path, typically triggered by user input that feeds the include filename. Inferred attack vectors include unauthenticated or low‑privilege users capable of sending crafted requests that result in local file inclusion. The vulnerability is not listed in CISA’s KEV catalog, so there are no known widespread public exploitation cases at this time.