The Makeaholic theme contains an improper validation of filenames used in include/require statements, enabling PHP Local File Inclusion. The flaw permits the theme to include any file specified in a request, which can expose the server’s local filesystem contents.

All installations of the Makeaholic theme from ThemeMove up to and including version 1.8.4 are affected. The vulnerability does not impact WordPress core or other plugins; any site running an affected theme instance is at risk.

The CVSS score of 8.1 indicates high severity, while the EPSS score of <1% suggests a relatively low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to involve a crafted request that supplies a malicious file path to the theme’s PHP code. Successful exploitation would allow an attacker to read arbitrary local files, potentially revealing sensitive data.