The Karzo theme contains an improper control of filenames used in PHP include/require statements, permitting an attacker to trigger local file inclusion (LFI). If successfully exploited, the attacker can read arbitrary files from the WordPress installation and potentially execute arbitrary PHP code, leading to a compromise of the site’s confidentiality, integrity, or availability.

The vulnerability is present in all versions of the designervily Karzo WordPress theme up to, but not including, 2.6. Any WordPress site that has installed the Karzo theme in the affected version range is susceptible.

The CVSS score of 8.1 indicates a high impact vulnerability, and the EPSS score of <1% suggests a low current exploitation probability, although the risk remains significant. The vulnerability is not listed in the CISA KEV catalog. Exploitation typically occurs when an attacker crafts a request that forces the theme to include an arbitrary file path, allowing local filesystem access. No specific prerequisites are noted beyond the presence of the vulnerable theme; the attack surface is likely exposed via publicly accessible WordPress URLs that trigger the inclusion logic.