This vulnerability is caused by improper control of filenames used in PHP include/require statements within the ThemeMove Businext WordPress theme. An attacker who can influence the filename can trigger a local file inclusion, enabling them to read sensitive files, exfiltrate data, or execute arbitrary code on the server. The weakness is categorized as CWE‑98, which directly maps to a Local File Inclusion flaw.\n

The affected products are ThemeMove’s Businext WordPress theme. All releases from the initial available version up to any version earlier than 2.4.4 are impacted. No specific minor versions are enumerated beyond the upper boundary of 2.4.4.\n

The CVSS score of 8.1 denotes high severity, indicating substantial impact on confidentiality, integrity, and availability if successfully exploited. The EPSS score being less than 1% suggests a low current likelihood of exploitation, though the flaw remains present on unpatched installations. It is not listed in the CISA KEV catalog. The probable attack vector is local to the web server, requiring that the attacker can send crafted requests that influence the include path, which is typically possible through exposed URLs or form inputs. The flaw does not require specialized conditions beyond standard web application usage, making it accessible to attackers with web access.