The Woo Hoo WordPress theme contains an improper control of filename in a PHP include/require call, allowing an attacker to read or execute arbitrary files on the server. Successful exploitation can lead to disclosure of sensitive configuration data, user credentials, and, in the worst case, execution of unintended PHP code that undermines the confidentiality and integrity of the site.

All releases of the Woo Hoo theme from the initial unstable release through version 1.25 are affected. Any WordPress installation that has not upgraded beyond 1.25 poses a risk, as the faulty include logic is present in all files of the theme.

The CVSS score of 8.1 signals high severity, while the EPSS score of less than 1% indicates a low probability of broad exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attacker must be able to influence a file path parameter in a request that triggers the vulnerable include, typically via a specially crafted URL or configuration entry. Once triggered, the attacker can read or execute files on the server, potentially escalating to a full site compromise.