Improper control of filename for the include/require statement in the Xcare theme’s PHP code allows an attacker to perform local file inclusion, potentially reading sensitive files or executing arbitrary code. This weakness corresponds to CWE‑98 and can compromise confidentiality, integrity, and availability of the WordPress site.

The Xcare theme from Designervily is affected. All releases prior to version 6.5 are vulnerable; users running any older version should plan to upgrade.

With a CVSS score of 8.1 the vulnerability is rated high severity, while the EPSS score of less than 1 % indicates a low current exploitation probability but not zero. The issue is not in the CISA KEV catalog. The likely attack vector involves the theme’s file inclusion mechanisms, which an attacker could exploit through crafted requests or by manipulating theme files, potentially leading to file disclosure or code execution if writable files are included.