The Ruza theme for WordPress contains an improper control of filenames used in PHP include/require statements, which allows an attacker to trigger local file inclusion. This flaw can enable the reading of arbitrary files within the web server’s file system, potentially exposing configuration files, credentials, or private data, and may also allow execution of attacker-supplied PHP code if the included file contains executable code.

The vulnerability affects the WordPress Ruza theme from version 1.0.7 and earlier, released by thembay. Any WordPress installation using Ruza 1.0.7 or older is susceptible.

The CVSS score of 8.1 reflects high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to influence the value passed to the include/require call, which can be achieved through user-controlled input such as a query parameter or a theme-specific setting. Successful exploitation would allow local file reads and potentially PHP code execution if the attacker can supply a PHP file.