Improper control of the filename used in a PHP include/require statement in the Blogvy theme allows an attacker to include arbitrary local files. The vulnerability can lead to disclosure of sensitive information or execution of attacker‑supplied code, thereby compromising confidentiality and integrity. The weakness is a Local File Inclusion flaw, classified as CWE‑98.

The insecure Blogvy theme from unfoldwp, version 1.0.7 and earlier, is susceptible. The affected range is from the initial release up through 1.0.7. All sites using these versions of the theme are vulnerable.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of < 1% shows a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted request that manipulates the filename parameter used by the theme’s PHP code, enabling the inclusion of sensitive files or arbitrary code execution. The vector requires the attacker to be able to influence the input to the include/require statement, typically through a web request.