The Töbel theme implements a file inclusion mechanism that does not properly sanitize the filename supplied to PHP's include/require statements. This flaw, classified as CWE‑98, lets an attacker supply an arbitrary local file path, enabling the read of sensitive files from the server or the execution of arbitrary PHP code if the attacker can place malicious files in a writable directory.

The vulnerability is present in the Töbel theme version 1.6 and earlier. The affected product is Elated‑Themes Töbel for WordPress. No specific sub‑versions are distinguished – any installation of 1.6 or lower is affected.

The vulnerability carries a CVSS score of 8.1, indicating high severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of scoring, and the issue is not listed in the CISA KEV catalog. The attack vector is likely remote via a web request that can invoke the vulnerable include, since the flaw is within a WordPress theme accessed over HTTP. An attacker with sufficient privileges could exploit this to read configuration files or execute PHP code, potentially taking control of the affected WordPress site.