Improper control of filename handling in the WoodMart theme’s PHP include/require logic allows an attacker to manipulate the path of files loaded by the server. The flaw can be triggered via user‑supplied input, giving the attacker the ability to read arbitrary local files or inject PHP code. An exploited local file inclusion can lead to disclosure of sensitive configuration files or execution of malicious scripts, effectively compromising the integrity and availability of the web application.

The vulnerable product is the WoodMart theme developed by xtemos. Versions through and including 8.3.1 are affected, while version 8.3.2 and later are not impacted.

With a CVSS score of 7.5 and an EPSS score below 1%, the vulnerability poses a moderate to high risk. It is not currently listed in the CISA KEV catalog. The likely attack vector is through web‑based input that influences the filename used in PHP’s include or require statements, allowing remote actors to leverage the weakness to include unintended files or execute code.