The vulnerability originates from an improper control of filenames in PHP include/require statements within the Lindo theme, enabling an attacker to include arbitrary local files. An attacker who succeeds can read sensitive files on the server, potentially exposing configuration data, credentials, or user information, and could execute code if they can influence the included file to contain executable content. This flaw is categorized as CWE‑98 and carries a CVSS score of 8.1, indicating a high severity impact on confidentiality and integrity of the affected system.

The affected product is the Goalthemes Lindo WordPress theme. All versions from the initial release up to and including version 1.2.5 are vulnerable. Users running any of those versions face the risk described.

The EPSS score of less than 1% suggests that the likelihood of exploitation at any given time remains low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the high CVSS score highlights serious potential impact. The most likely attack vector is via crafted URLs or inputs that control the filename in the theme’s PHP code; an attacker would need to be able to influence the include path, which typically requires access to the site’s publicly reachable files or administrative privileges. The vulnerability does not require remote code execution at the PHP level but can lead to sensitive data exposure or subsequent exploitation through other flaws.