Improper control of the filename used in a PHP include/require function allows a local file inclusion flaw in the MaxShop theme. An attacker who can influence the filename parameter may cause the theme to read arbitrary files from the server’s filesystem, potentially exposing sensitive data or enabling the use of locally stored PHP code. The vulnerability directly compromises the integrity of the file system and confidentiality of configuration files.

WordPress sites that employ the MaxShop theme version 3.6.20 or earlier are affected. All earlier releases of the theme distributed by magentech contain the flaw.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA KEV. It is inferred that exploitation would require a crafted request pointing the include to a local file, meaning the attacker must be able to send a request to the vulnerable WordPress installation and, optionally, to place a PHP file on the server to achieve remote code execution.