magentech Revo theme suffers from improper control of filenames used in PHP include/require statements, allowing local file inclusion. The weakness, identified as CWE-98, is inferred to allow a remote attacker to send crafted requests that cause the theme to read or execute arbitrary files on the server, potentially exposing sensitive data or executing malicious code. The impact is local to the web host and can lead to confidentiality and integrity compromise of server files.

All installations of the Revo WordPress theme from its initial release through version 4.0.26 are affected. The vulnerability is reported for the magentech Revo theme, with affected versions listed as "<= 4.0.26".

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker could exploit the flaw by sending a crafted HTTP request to the WordPress site that forces the theme to include a local file, potentially allowing the attacker to read sensitive files or execute arbitrary code and fully compromise the system.