Improper validation of filenames used in PHP include/require statements enables attackers to specify arbitrary paths and read files on the local filesystem, resulting in potential disclosure of sensitive configuration data, credentials, or other confidential information. The vulnerability is classified as CWE‑98, indicating a local file inclusion flaw.

The flaw affects the Favethemes Houzez WordPress theme in all releases prior to version 4.1.4; versions 4.1.4 and later contain a fix.

The base CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % implies a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits have been reported. The likely attack vector is local file inclusion; exploitation is feasible where an attacker can influence file paths, such as through theme configuration options or user‑controlled parameters.