The Diza WordPress theme contains an improper controlled filename for include/require, which allows a local file inclusion (LFI) flaw. This vulnerability enables an attacker to include arbitrary files from the server’s filesystem, potentially exposing sensitive configuration files or executing malicious code. The impact is severe; successful exploitation can compromise confidentiality and integrity of the hosted WordPress site.

This weakness exists in the Diza theme distributed by thembay, affecting all releases starting from the first noted version through 1.3.8. Any WordPress installation that has this theme installed and has not been updated beyond 1.3.8 is vulnerable.

The CVSS score of 8.1 classifies the issue as high severity, but the EPSS score of less than 1% shows a currently low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through normal web traffic to the site, where an attacker can craft a request to the theme’s inclusion endpoint to specify a local file. No additional authentication or privilege escalation is required, making the risk accessible to unauthenticated users who can send crafted URLs.