The Dwell theme for WordPress contains an include/require statement that accepts a file name without proper validation. This flaw, classified as CWE-98, permits a user-controlled file name to be used in the PHP include, enabling the reading or execution of arbitrary local files. An attacker who can supply the filename can potentially run code on the server, compromising the WordPress installation or the underlying system.

All installations of the WordPress Dwell theme with version numbers 1.7.0 or earlier are affected; the vulnerability is present in every build from the theme’s initial release up until that version.

The CVSS score of 8.1 signals high severity, while the EPSS score of less than 1% denotes a low but nonzero chance of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been confirmed. The inclusion point is likely reachable from an input that reaches the theme’s include logic, so web administrators should treat the threat with caution, especially if the site allows external users to influence the filename parameter.