Improper control of filenames used in PHP include/require statements results in a Local File Inclusion vulnerability. An attacker can craft a request that manipulates the included path, allowing access to arbitrary files on the server. Although the description does not explicitly state subsequent Remote Code Execution, reading sensitive files can open the door to further exploitation or data exposure.

The Eldon theme by Edge-Themes, versions from the original release up to 1.0 inclusive, is affected.

The CVSS score of 8.1 indicates high severity, yet the EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of an LFI flaw, the likely attack vector involves manipulating a user‑controllable path parameter through a web request that triggers the insecure include operation. No publicly known exploit is cited, but the risk remains if the issue remains unpatched.