The Muji theme for WordPress permits inclusion of arbitrary local files through an unchecked filename supplied to a PHP include statement. This flaw allows an attacker to read any file that the web server’s process can access, exposing sensitive configuration files, credentials, or other secrets. The vulnerability is a classic Local File Inclusion (LFI) issue arising from improper control of filenames in PHP code.

All WordPress installations that use the Muji theme version 1.2.0 or earlier are affected. AncoraThemes Muji distributions from the legacy release through <=1.2.0 contain the vulnerable include logic.

The CVSS score of 8.1 indicates a high severity flaw. The EPSS probability is listed as less than 1 percent, suggesting that current exploitation attempts are unlikely but the risk persists. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could supply a path or filename via a request parameter that bypasses the check and triggers the include, enabling arbitrary file reads. Successful exploitation would depend on the server’s file permissions and PHP configuration, but no remote code execution capability is explicitly documented in the input.