An improper control of filenames in the PHP include/require statements of the XpeedStudio Bajaar theme enables local file inclusion. The vulnerability permits an attacker to supply a file path that the theme attempts to include, allowing the attacker to read or execute arbitrary code residing on the file system. This flaw directly maps to CWE‑98 and can compromise the confidentiality, integrity, and availability of the WordPress site, potentially resulting in full site takeover.

The affected product is the XpeedStudio Bajaar – Highly Customizable WooCommerce WordPress Theme, versions from the initial release up through 2.1.0. WordPress sites utilizing this theme in its up‑to‑date 2.1.0 or earlier builds are susceptible.

The CVSS score of 8.1 categorizes this as a high‑severity vulnerability. The EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a crafted request that manipulates the theme’s include path, which the malicious actor supplies through user input. Once triggered, the flaw can lead to remote code execution or other destructive actions on the host.