The Rosalinda theme for WordPress contains an improper control of filename in an include/require statement, which leads to PHP Local File Inclusion. This flaw allows an attacker to specify an arbitrary local file path, potentially exposing sensitive configuration, logs, or executing arbitrary code if local files contain executable code. The vulnerability is identified as CWE‑98.

Affected systems include the WordPress theme ‘Rosalinda’ released by Axiomthemes. Versions up to and including 1.2.3 are vulnerable; any installation running these versions is at risk.

The CVSS score is 8.1, indicating high severity. The EPSS less than 1% indicates low exploitation probability at the time of assessment, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to exploit the vulnerable file inclusion logic, likely by submitting a crafted file path via a user‑controllable input. No public exploits are documented, but the low EPSS does not eliminate the need for prompt remediation.