The flaw is an improper validation of a filename that is fed into a PHP include or require statement within Elated-Themes' Search & Go theme. Because the filename is not filtered or sanitized, an attacker can cause the theme to include arbitrary local files on the web server. This results in the ability to read the contents of files that are normally not exposed through the web interface. The vulnerability is classified as CWE-98.

WordPress installations that use the Search & Go theme from Elated-Themes, version 2.8 or earlier. Any site deploying those versions is susceptible; the issue does not apply to newer releases beyond 2.8 if they have been updated.

The CVSS score of 8.1 marks the flaw as high impact. An EPSS score of less than 1% indicates a low likelihood of known exploitation at this time, and the vulnerability is not present in the CISA KEV catalog. The attack vector is remote in that it can be triggered via a web request that supplies a crafted filename to the theme’s PHP code. An attacker with internet access who can influence the filename argument could read sensitive configuration or code files, potentially exposing data or providing a foothold for further attacks depending on server configuration.