The vulnerability is an unauthenticated local file inclusion flaw present in all Dazzle theme releases up to version 1.0.0. Attackers can supply arbitrary file paths to theme scripts, potentially allowing them to read any file accessible to the web server. This represents a confidentiality breach that could expose configuration data, credentials, or other sensitive information. The weakness is identified as CWE‑98, which reflects an insufficient control over local file access during input handling.

The WordPress Dazzle theme developed by ThemeREX is impacted. All versions of the theme up to and including 1.0.0 are vulnerable. Administrators should verify whether the theme is currently installed and, if so, what version is active.

The CVSS score of 8.1 places this vulnerability in the high‑severity category. EPSS data is not available, so a precise assessment of current exploitation likelihood cannot be made, but the flaw is unauthenticated and may be readily exploited by sending crafted requests to the affected theme’s endpoints. The vulnerability is not listed in the CISA KEV catalog at this time. Attackers could target any site using the affected theme without requiring credentials, making mitigation through patching or removal the most effective countermeasure.