The FitLine theme contains an improper control of filename for include/require statements that permits local file inclusion in PHP. An attacker can direct the theme to read arbitrary files from the server, such as configuration files or other sensitive data, and may achieve remote code execution if a malicious PHP script can be made accessible and included.

WordPress installations running the FitLine theme version 1.6 or earlier are affected. The vulnerability exists in all releases from the initial version up to and including 1.6.

The CVSS score of 8.1 reflects a high severity, and the current EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Attacks are expected to exploit the theme’s inclusion mechanism via crafted input or URLs that influence the include/require path. The exact prerequisites are not detailed, but typical local file inclusion requires the attacker to control a file path parameter used by the theme. If exploited successfully, an attacker can read local files and may run arbitrary code on the server.