The flaw stems from inadequate validation of filenames used in a PHP include/require statement within the beeteam368 VidoRev WordPress theme. As a result, an attacker can supply a filename that leads the server to include any file from the local filesystem. This can expose sensitive files to the attacker and, in circumstances where the included file contains executable PHP code, could allow that code to run on the web server.

The vulnerability affects the beeteam368 VidoRev theme for WordPress. All releases from the earliest available version through 2.9.9.9.9.9.7 are susceptible. WordPress installations deploying any of these theme versions are impacted.

The CVSS score of 7.5 indicates a high severity of impact. The EPSS score of less than 1% suggests that, at present, exploitation attempts are expected to be uncommon. The vulnerability is not listed in the CISA KEV database, so no widespread exploitation campaigns are known. The likely attack vector is a crafted HTTP request to a page or endpoint of the vulnerable theme that supplies a controlled filename parameter to trigger the PHP include logic. Successful exploitation would give the attacker the ability to read arbitrary files on the server or, if a malicious PHP script can be placed in a reachable location, execute that script on the server.