The Photography theme from ThemeGoods contains an improper filename sanitization flaw that allows attackers to manipulate the include/require statement in PHP. This vulnerability can lead to local file inclusion on the web server, potentially exposing sensitive files or allowing code execution depending on the server configuration and the files that can be included. The flaw is rated CVSS 8.1, indicating a high severity impact on confidentiality and integrity.

WordPress installations that use the Photography theme version 7.7.4 or earlier are affected. Any site that has not upgraded to 7.7.5 or newer is vulnerable.

The CVSS score of 8.1 signals a major risk, but the EPSS score of less than 1% suggests that exploit attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve crafting a request that provides an attacker‑controlled file path to the include/require call; if the application accepts user‑supplied filenames without proper validation, an attacker may exploit the flaw remotely without needing privileged access.