Technical impact
Contributor Local File Inclusion was discovered in versions up to 4.4.3 of the Splash theme, a weakness classified as CWE‑98. This flaw allows an attacker to request arbitrary local file paths, leading to the disclosure of sensitive files such as WordPress configuration, database credentials, or other confidential data. The vulnerability is not confined to information leakage; an attacker could potentially include files containing vulnerable code, creating a pathway to further exploitations such as remote code execution if additional weaknesses exist.
Affected Systems
The Splash – Sport Club WordPress Theme for Basketball, Football, Hockey, developed by StylemixThemes, is affected in all releases up to version 4.4.3 inclusive. Versions 4.4.4 and later contain the remediation for this issue.
Risk and Exploitability
The CVSS score of 7.5 marks this flaw as high severity, and the absence of an EPSS score does not provide a quantitative likelihood, though LFI is a common attack vector with significant real-world exploitation. The theme is not listed in the CISA KEV catalog, but the potential to read arbitrary files raises a tangible threat profile, especially if the WordPress installation is exposed to the public internet.
