The Barberry theme contains an improper control of the filename used in include/require statements, allowing a local file to be read or executed. This can expose sensitive configuration files or other data and, if combined with a suitable input, may enable arbitrary code execution. The weakness is classified as CWE‑98, which informs that the flaw stems from insecure handling of file names.

The vulnerability affects the temash Barberry theme for WordPress from the earliest released version through version 2.9.9.87. All installations of these versions are at risk until patched.

The CVSS score of 8.1 indicates high severity, while the EPSS score of <1% suggests that, although exploitation is unlikely, not impossible. The theme is not listed in the CISA KEV catalog. The attack likely requires influencing a user’s request to the site—i.e., accessing a URL or submitting a form that contains the vulnerable filename parameter—after which a relative path can be resolved to any file on the server. This pathway is accessible over the network and does not require additional local privileges.