The Zota WordPress theme contains improper validation of filenames used in PHP include/require statements, which allows an attacker to request a URL that causes the theme to read an arbitrary file from the server. This flaw can expose confidential data or deliver a PHP file that may execute on the host. Based on the description, it is inferred that executing arbitrary PHP code is possible if the attacker controls the file path.

WordPress installations that use the Zota theme version 1.3.14 or earlier are affected; the issue exists from the earliest releases up to and including 1.3.14. Users should upgrade to 1.3.15 or later, or remove the theme entirely.

The CVSS score of 8.1 classifies the flaw as high severity, but the EPSS score of less than 1% indicates that current exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require a crafted HTTP request that supplies a manipulated filename to the theme’s include logic. Based on the description, it is inferred that if the included file contains executable PHP, the attacker may achieve code execution, potentially escalating to full server compromise.