WordPress theme Yolox contains an LFI vulnerability due to improper validation of a filename supplied to a PHP include statement. This flaw can allow an attacker to read arbitrary local files or, if the attacker can influence the included file to contain PHP code, execute it. The weakness is classified as CWE-98, indicating lack of proper control of file name. The primary impact is disclosure of sensitive configuration files and the potential to compromise the entire WordPress installation.

All versions of the AncoraThemes Yolox theme up to and including 1.0.15 are affected. The vulnerability is present in every release from the initial version through 1.0.15. Users running WordPress with any of these versions of the theme should consider the theme version a risk.

The CVSS score of 8.1 signals high severity, but the EPSS score is under 1%, indicating low projected exploitation probability. The flaw is not listed in CISA KEV. This LFI typically requires the attacker to supply a crafted URL or request that influences the theme’s file inclusion logic. Since no authentication requirement is mentioned, inclusion likely requires public web access, giving attackers a straightforward attack vector.