The Madara WordPress theme is vulnerable to Local File Inclusion in all releases up to 2.2.2 through manipulation of the template parameter. An unauthenticated attacker can supply an arbitrary file path, causing the server to include and execute its contents as PHP code. This allows bypassing of normal access controls, the theft of sensitive data, or full server compromise if the attacker can upload or reference PHP files.

The vulnerability affects the WPStylish Madara theme for WordPress, with all versions 2.2.2 and earlier at risk. No other products or vendors are listed as impacted.

The CVSS score of 9.8 indicates high severity, and the EPSS of 4% suggests a moderate probability of exploitation. The vulnerability is not in CISA's KEV catalog. The likely attack vector is remote via the web interface; an attacker only needs to craft a request containing a malicious template value to trigger inclusion, with no authentication required. If the site allows uploading of PHP or other executable files, the attacker may also reference those to achieve arbitrary code execution.