Improper control of filenames for include/require in the Eduma theme allows a local file inclusion vulnerability. The flaw permits attackers to supply arbitrary file paths to the include mechanism, potentially reading sensitive configuration files or, if a PHP file is successfully included, executing arbitrary code. This weakness is captured by CWE‑98 and can lead to information disclosure or remote code execution, compromising the confidentiality and integrity of the affected WordPress installation.

The affected product is the ThimPress Eduma WordPress theme. Versions from the earliest releases through 5.7.6 are vulnerable. Administrators should verify that their site is using a version older than 5.7.6 and plan to upgrade if applicable.

The CVSS score of 7.5 classifies this issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. However, the flaw can be triggered by a public web request that manipulates the filename parameter, offering an unauthenticated route to read local files or execute code. Attackers would need only HTTP access to reach the vulnerable include path. While the odds of exploitation are low, the potential impact warrants prompt remediation.