The Blogmine theme contains an improper control of the filename used in an include/require statement within its PHP code. This flaw allows a local file inclusion that can read arbitrary files on the server or trigger the execution of arbitrary code if a remote file can be injected. As a result, a malicious actor who can influence the inclusion path would be able to read sensitive configuration files, retrieve database credentials, or execute code with the privileges of the web server.

The vulnerability affects WordPress installations that use the unfoldwp Blogmine theme, version 1.1.7 or earlier. Users running these versions are at risk until they upgrade.

The CVSS score of 8.1 ranks this flaw as high severity. However, the EPSS score of less than 1% indicates a low probability of real‑world exploitation at this time. The vulnerability is not included in CISA's KEV catalog, and there is no known widespread exploitation. The most likely attack path involves a user or attacker crafting a request that influences the include path, possibly by manipulating a GET or POST parameter that is not properly sanitized. Because the weakness hinges on a lack of input validation (CWE‑98), attackers with access to the site’s input vectors can potentially trigger the flaw.