The Cerebrum WordPress theme contains an improper control of the filename used in a PHP include/require statement, enabling local file inclusion. An attacker who can influence the file path parameter may cause the theme to include arbitrary files on the server, leading to disclosure of sensitive data or execution of malicious code if the included file is processed as PHP. This flaw aligns with CWE‑98 and can compromise confidentiality, integrity, and potentially availability of the site.

The vulnerability affects all released versions of the Cerebrum theme up to and including 1.12. Users running WordPress with this theme version are at risk, regardless of the underlying WordPress edition.

The CVSS base score of 8.1 indicates a high severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. Likely exploitation requires a user‑controlled input that is passed directly to the include/require path, such as a malformed query string or theme configuration option. Once triggered, the attacker can read arbitrary files or inject PHP code, enabling further compromise.