The Exhibz theme for WordPress contains a flaw that allows untrusted input to control the filename passed to PHP's include/require. This improper validation (CWE-98) can let an attacker read arbitrary files on the server, and if the goal is to read writable PHP files, can lead to remote code execution. The vulnerability is reported by CVE-2025-67523.

The issue affects all versions of the Exhibz theme from the initial release through 3.0.9. Administrators of WordPress sites using trippleS Exhibz should verify the active theme version.

The vulnerability carries a CVSS score of 7.5, indicating high severity, while the EPSS score of <1% suggests that exploitation remains uncommon but still viable. The flaw is not listed in the CISA KEV catalog, and no documented exploits are publicly known. Attackers would likely exploit the vulnerability by injecting a crafted filename parameter into the theme's include logic, which requires having the ability to send requests to the target WordPress installation. The data indicates that local filesystem access is required, so the attack vector appears to be local file inclusion from within the web application.