The report identifies a flaw in the WordPress Unicamp theme where an attacker can control the filename supplied to PHP include/require statements. This improper handling of user input, classified as CWE‑98, results in a local file inclusion vulnerability. The impact includes the potential to read sensitive files on the server such as configuration files, passwords, or backups, and in some contexts may lead to remote code execution if the included file contains executable PHP code. The vulnerability is confined to the theme’s internal code and does not directly affect WordPress core or other plugins.

The flaw affects any installation that uses the Unicamp theme from ThemeMove for WordPress, specifically all releases from the earliest available version up to and including version 2.6.3. No other vendor or product versions are mentioned as vulnerable.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% shows that, while the vulnerability is serious, the likelihood of exploitation remains low at present. It is not listed in the CISA KEV catalog. Exploitation typically requires the attacker to be able to influence the filename passed to the theme’s include/require logic, which may be possible through crafted URLs or form inputs. The attack vector is therefore local file inclusion, with potential remote code execution if the attacker can include a writable file that contains malicious code.