The Good Mood theme allows unvalidated use of a filename in a PHP include or require statement, enabling a local file inclusion flaw. If exploited, an attacker can read arbitrary files from the web server or potentially execute code if a writable or remotely fetchable file is included. This flaw aligns with CWE-98 and poses a high risk to confidentiality and integrity of the site’s files.

The vulnerability affects the WordPress Good Mood theme from its initial version through any release up to and including 1.16. Users running WordPress with this theme must verify their installed theme version; any version of Good Mood 1.16 or earlier is impacted.

The CVSS score of 8.1 categorizes the flaw as High severity. The EPSS score of under 1% indicates that, as of the latest data, the probability of public exploitation is very low, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local, exploiting a path that the theme uses without proper validation; it may be triggered through a front‑end request that passes a file name to the theme. If an attacker can control the file name or access the theme’s hosting environment, the LFI could be abused to read backups, configuration files, or system binaries, potentially leading to further compromise.