The Lekker theme for WordPress includes a flaw where the filename used in an include or require statement is not properly controlled, creating a Local File Inclusion vulnerability classified under CWE-98. An attacker who can influence the filename parameter can cause the server to include unintended files, potentially giving the attacker the ability to read sensitive files or execute arbitrary PHP code. The CVSS score of 8.1 reflects the high impact on confidentiality, integrity, and availability if the flaw is exploited.

This issue affects the Mikado-Themes Lekker WordPress theme, versions n/a through 1.8. Only installations using a version equal to or older than 1.8 are vulnerable; versions 1.9 and later are not impacted.

The EPSS score is less than 1%, meaning the probability of exploitation is considered very low, and the vulnerability is not listed in CISA’s KEV catalog. However, the high CVSS score indicates that if an attacker gains entry to influence the include path, they could achieve remote code execution or data compromise. The attack likely requires user-supplied input that determines the filename, such as a GET or POST parameter, and does not depend on elevated privileges or privileged services.