Improper control of filename in PHP include/require allows a local file inclusion vulnerability in the Digiqole theme. An attacker can supply a crafted filename parameter that bypasses normal validation and causes the server to read and execute files from the local filesystem, potentially leading to arbitrary code execution or information disclosure. This weakness reflects the CWE-98 vulnerability class.

The affected product is the Digiqole WordPress theme supplied by trippleS. Versions prior to 2.2.7 are vulnerable; the problem exists from the initial release up through any version less than 2.2.7.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1 %, indicating a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw relies on an included filename that can be influenced by a user-supplied parameter, an attacker with local or remote access could exploit the LFI to read or execute arbitrary files. The likely attack vector is through a crafted HTTP request targeting the vulnerable PHP script that performs the include/require operation.