This vulnerability is an improper control of filename in a PHP include/require statement, classified as CWE-98. An attacker can craft a request that forces the theme to include a local file, potentially exposing sensitive server files or giving the attacker a foothold for further exploitation. The description indicates an LFI attack vector that, if an include path is executed, could allow reading of arbitrary files or execution of malicious code built into the local filesystem.

WordPress sites using the ThemeMove MinimogWP theme, versions up to and including 3.9.6. The affected component is the theme’s file inclusion logic within WordPress.

The CVSS score of 7.5 signals significant severity, though the EPSS score of less than 1% suggests the likelihood of exploitation is low at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires the ability to trigger the theme’s file inclusion logic, which can be done through a crafted URL or form input, implying that unauthenticated users may be able to exploit this depending on the site’s configuration. Successful exploitation could lead to disclosure of confidential data or remote code execution if the included file is maliciously crafted.