The Sapa theme for WordPress contains a flaw where the filename used in an include/require statement is not properly validated, allowing attackers to influence the path and include arbitrary local files. This can be leveraged to read sensitive files or execute uploaded PHP code, potentially giving attackers remote code execution. The weakness corresponds to CWE-98.

Themabay’s Sapa WordPress theme, versions up to and including 1.1.14. All installations using these versions are vulnerable.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% points to a low probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Exploit attempts would likely funnel through a publicly exposed parameter that feeds the filename into the theme’s include/require logic, potentially by unauthenticated users. If successful, an attacker could read arbitrary files or execute code stored on the server.