The MinimogWP theme contains an improper control of filename in PHP include/require statements, enabling local file inclusion. An attacker who can influence the file path may read or execute arbitrary files on the server, potentially leading to data disclosure, unauthorized code execution, or full site compromise. The weakness is identified as CWE‑98, a classic input validation flaw that leverages PHP’s file inclusion semantics for exploitation.

All installations of the MinimogWP WordPress theme from ThemeMove that use version 3.9.6 or earlier are affected, regardless of additional plugins or server configurations. The vulnerability applies to any WordPress instance hosting the affected theme.

With a CVSS score of 8.1, the issue is classified as high severity, while an EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. Attackers are likely to exploit the vulnerability by manipulating request parameters or template inputs that feed the insecure include/require logic, potentially granting them the ability to read sensitive files or execute code if the server environment permits.