The Kleo theme in versions prior to 5.5.0 contains an improper control of the filename used in PHP include or require statements. This defect allows an attacker who can influence the filename value to cause the application to include arbitrary files from the server’s filesystem. The attacker could read sensitive files such as configuration files or credentials, thereby compromising confidentiality. If the attacker can supply a file that contains executable PHP code, the flaw may also enable remote code execution; this possibility is inferred from the nature of the vulnerability.

All WordPress sites that have installed the Kleo theme from SeventhQueen with a version earlier than 5.5.0 are affected. Versions 5.5.0 and later no longer contain the issue.

The CVSS score of 7.5 indicates a medium‑to‑high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely exploit it by crafting web requests that manipulate the theme’s file inclusion logic; any user who can influence the filename could trigger the flaw. The ease of exploitation and potential for confidentiality loss or remote code execution make immediate remediation advisable.