The Neo Ocular WordPress theme has an improper control of filenames used in PHP include/require statements, which enables a local file inclusion vulnerability. An attacker can supply a crafted value that causes the application to include an arbitrary file from the local filesystem, potentially allowing the attacker to read sensitive configuration files or execute malicious PHP code if the included file is executable. This flaw is classified as CWE‑98 and carries a CVSS score of 8.1, indicating high severity.

All installations of the Neo Ocular theme by Elated‑Themes running versions earlier than 1.2 are affected. The vulnerability resides in theme files that perform unsanitized include/require operations, therefore any WordPress site that uses the pre‑1.2 releases is at risk.

We can infer that an attacker would need to influence the path used in an include/require statement, for example through a crafted URL parameter, a manipulated form field, or local administrative access. The EPSS score of less than 1% suggests that current exploitation activity is low, and the vulnerability is not listed in CISA KEV. Nevertheless, local file inclusion can compromise confidentiality or integrity of the site, and the high CVSS score emphasizes the need for timely remediation.