The Putter WordPress theme versions 1.17 and earlier contain a Local File Inclusion flaw that does not require user authentication. Based on the description, it is inferred that an attacker could craft a web request, manipulating query strings or request parameters, to cause the theme to include files from the server’s filesystem. When such files are parsed by WordPress, sensitive information such as configuration files or passwords may be exposed, and in some scenarios executable code may be injected leading to server compromise. The weakness is classified as CWE-98.

The vulnerability affects all releases of the ThemeREX Putter WordPress theme up to version 1.17 inclusive.

The CVSS base score of 8.1 indicates high impact and the EPSS score of less than 1% suggests limited exploitation in the wild. The flaw is unauthenticated and can be exercised by any web-connected user, making it relatively easy to target. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of a high severity score and lack of authentication makes it a valuable target for attackers once discovered.