Improper control of the filename used in PHP include/require statements in the XStore WordPress theme allows attackers to read or execute arbitrary local files. This flaw is identified as CWE‑98 and carries a CVSS score of 7.5, indicating high severity. The vulnerability potentially enables remote code execution if critical files are included, or unauthorized disclosure of sensitive data such as configuration files.

All installations of the 8theme XStore WordPress theme running any version before 9.6.1 are vulnerable. No specific vendor patch is listed in the data, so any pre‑9.6.1 deployment remains at risk until updated to the fixed release.

The EPSS score is below 1 %, suggesting that widespread exploitation is unlikely at the time of analysis and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be a local or remote request that manipulates the filename parameter used in include/require calls; by supplying a crafted path, an attacker can trigger the theme to include unintended files. If successfully exploited, the attacker could read sensitive files or execute arbitrary PHP code, leading to full system compromise. The high CVSS score underscores the serious impact potential, even though the observed exploitation risk remains limited.