Unauthenticated Local File Inclusion exists in WordPress Orpheus theme versions 1.3 and earlier, allowing an attacker to supply a file path that the theme code includes without proper. This flaw can expose sensitive files such as configuration credentials or, if an attacker can include executable code, lead to remote code execution. The vulnerability stems from missing input sanitization identified as CWE‑98.

All installations of the WordPress Orpheus theme from ThemeREX running version 1.3 or earlier are affected. No other products or versions are listed; only the theme up to and including 1.3 is known to be vulnerable.

The CVSS score of 8.1 classifies the issue as high severity. While EPSS data is unavailable, the lack of mitigation information and the critical impact of LFI suggest a substantial risk of exploitation. The flaw is not listed in the CISA KEV catalog, but the combination of unauthenticated access and the potential for remote code execution warrants immediate attention. An attacker would likely trigger the inclusion via crafted requests to vulnerable theme endpoints, exploiting the lack of user authentication and inadequate path validation.