Improper control of the filename supplied to an include/require statement in the WordPress Neresa Theme allows a Local File Inclusion flaw. By manipulating the path, an attacker may read arbitrary files from the server or trigger unintended code execution, potentially exposing sensitive data or compromising the site.

The vulnerability affects the CocoBasic Neresa WordPress theme. All installed versions from the earliest release through version 1.3 of the Neresa theme are vulnerable.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers would need to inject a trusted path into the theme’s include call, meaning the attack vector is local file inclusion via manipulated input. Because the vulnerability requires the theme to process unsanitized file names, an attacker with a code‑execution or file‑write capability could exploit it, though no public exploit is documented.