The flaw arises from insufficient validation of filenames passed to PHP include/require statements in the Xinterio theme. An attacker may craft a request that forces the theme to include a chosen local file. This Local File Inclusion can enable the attacker to read sensitive files, expose configuration details, or potentially upload and execute malicious code if an attacker can control the included file’s content. The vulnerability corresponds to CWE-98.

The WordPress theme Xinterio from the vendor themeStek, versions from the earliest release (n/a) up to and including 4.2, is affected. WordPress sites that have installed any Xinterio theme at version 4.2 or earlier are susceptible.

The vulnerability carries a CVSS score of 8.1, indicating high severity. The EPSS score is below 1%, implying a low but nonzero likelihood that attackers will exploit it. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, through crafted web requests that manipulate the include path, because the Local File Inclusion is triggered within a PHP web application. Exploitation requires the attacker to influence the filename used in an include/require call; thus, it typically needs access to a publicly exposed endpoint that processes user input.