A flaw exists in how the Mikado-Themes Curly WordPress theme processes file names for PHP include/require calls, allowing attackers to point the theme at arbitrary local files. If an attacker can specify a file that contains PHP code, that code can be executed on the server, leading to full remote control of the site. The weakness is a classic Local File Inclusion issue classified as CWE‑98.

WordPress sites adopting the Curly theme from any unreleased revision up to, but not including, version 3.3 are affected. This includes any installation where the theme’s include logic is reachable, typically through theme‑specific widgets or page templates.

The vulnerability carries a CVSS score of 8.1, indicating high severity. The EPSS score is less than 1 %, suggesting exploitation is currently rare, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local file inclusion via crafted theme requests; the attacker must have the ability to influence the include path, which could be achieved through the theme’s front‑end controls or by manipulating query parameters. Successful exploitation would enable reading sensitive files or executing arbitrary PHP to gain full compromise of the WordPress instance.