The Cookiteer WordPress theme contains an improper control of filenames used in PHP include/require statements, allowing local file inclusion. This flaw, identified as CWE‑98, permits an attacker to read or execute files on the server when they can influence the path parameter supplied to the theme’s inclusion logic. The vulnerability carries a CVSS score of 8.1, indicating a high severity and potential for significant compromise if exploited.

Any WordPress installation running the Cookiteer theme version 1.4.8 or earlier, distributed by androThemes, is vulnerable. Versions prior to the first released Cookiteer and up through 1.4.8 are encompassed by the issue statement.

The CVSS score of 8.1 signals a high risk, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting limited documented exploitation. Attackers may trigger the vulnerability by submitting crafted requests that manipulate the file path supplied to the theme’s include/require calls, potentially enabling the reading of sensitive files or execution of malicious code if the server’s file system allows it. No specific server configuration details are given, so the exploitability depends on the PHP environment and file permissions in place on the target hosting infrastructure.