This vulnerability arises from improper validation of filenames used in PHP include/require statements within the Heart WordPress theme. An attacker who can manipulate the include path, likely through a crafted request to the theme, could trigger a local file inclusion that allows reading of arbitrary files or execution of malicious PHP code, thereby exposing sensitive data or enabling remote code execution.

The Heart theme by axiomthemes for WordPress is affected. All releases from the initial build, with no minimum version specified, through version 1.8 are vulnerable. The only version information provided is the upper bound of 1.8; individual patch levels within that range are not documented.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of less than 1 % suggests that few attacks are currently observed. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need the ability to influence the include path parameter, which typically requires some form of user input or configuration manipulation. The likely attack vector is local execution on the server, contingent on the theme processing directories that contain controlled filenames.