The Revolution WordPress theme contains a flaw that allows an attacker to control the filename passed to a PHP include or require statement. This improper input validation can lead to execution of arbitrary code on the web server, providing full compromise of the site. The weakness is classified as CWE‑98 – Improper Control of Filename for Include/Require Statement in PHP Program.

All installations of the fuelthemes Revolution theme that are older than version 2.5.8 are affected. The vulnerability applies to every site running the theme from its earliest releases through 2.5.7, and the fix is included in 2.5.8 and later releases.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score of less than 1% suggests that exploitation is unlikely at the present time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would trigger the vulnerable include via normal web traffic by crafting a request that supplies a malicious filename parameter, thereby achieving remote code execution.