The vulnerability in the unfoldwp Magazine theme allows an attacker to manipulate file paths passed to PHP include/require statements. This can lead to reading arbitrary local files or, if the included file contains executable PHP code, remote code execution. The weakness is a classic PHP Local File Inclusion flaw. The impact is a breach of confidentiality and possible compromise of the website’s integrity.

The issue affects the unfoldwp Magazine (eximious-magazine) Theme for WordPress with any version from the initial release up through 1.2.2. No specific minor patch is listed, so all releases at or below 1.2.2 are impacted.

The CVSS score is 8.1, indicating high severity. The EPSS score is below 1%, suggesting a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted request that causes the theme to include a local file; from there, the attacker can read file contents or execute code if publicly accessible files are included. The attack vector is inferred to be remote via a browser or API, as the theme’s include logic is available to external users.