Improper control of the filename used in PHP include/require statements in the Caliris Wordpress theme allows an attacker to supply arbitrary paths and load local files into the process. This flaw, classified as CWE‑98, can lead to disclosure of sensitive server files and, if a PHP file containing malicious code is accessed, remote code execution. The high CVSS score of 8.1 reflects the severe impact on confidentiality, integrity, and availability of WordPress sites that use the vulnerable theme.

The issue is present in the CocoBasic Caliris caliris‑wp theme for all releases from the initial version through version 1.5, inclusive. Any WordPress installation that has this theme installed at a version of 1.5 or earlier is vulnerable regardless of other security settings.

The EPSS score of than 1 % suggests that exploitation attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote via the web interface, where an attacker can send crafted HTTP requests that manipulate the file path parameter used by the theme. Successful exploitation depends on the server’s file permission configuration and the presence of PHP code in the targeted local files.