The vulnerability in the Dekoro WordPress theme allows an attacker to exploit improper filename control in a PHP include/require statement, resulting in local file inclusion that can be leveraged to read sensitive files or execute arbitrary PHP code. This directly compromises confidentiality and integrity of the website’s data and may lead to full remote code execution if the attacker can trigger the inclusion.

Goalthemes Dekoro theme versions up to and including 1.0.7 are affected. The issue is known to exist from an unspecified lower bound through version 1.0.7.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request that provides a malicious value to the inclusion parameter; from there an attacker can traverse locally stored files and execute PHP code through LFI.