Improper control of filename for include/require statements in the WordPress The7 Elements plugin allows a local file inclusion flaw. An attacker can supply a crafted file path that causes the PHP include mechanism to read arbitrary files on the server, potentially exposing sensitive configuration data, source code, or enabling remote code execution if a malicious file is included. The weakness is characterized as CWE‑98.

The vulnerability affects the Dream‑Theme The7 Elements plugin, specifically all releases from the initial version up to and including version 2.7.11.

The CVSS score of 7.5 indicates a high severity classification, while the EPSS score of less than 1 % suggests that exploitation is relatively uncommon but still possible. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need the ability to influence the filename parameter that is provided to PHP include/require, which is likely achieved via the plugin’s interface or by manipulating a request that the plugin processes. Given the high severity and the tolerated likelihood of exploitation, administrators should consider this a critical risk for exposed installations.