A flaw in the ThemeREX Cobble WordPress theme allows an attacker to supply an arbitrary filename to a PHP include/require statement. The improper validation can cause the theme to read and execute local files on the web server. The result can be discovery of sensitive configuration data, data exfiltration, or execution of arbitrary code, leading to full compromise of the affected site. The weakness is a classic filename-control issue (CWE-98).

The vulnerability exists in all releases of the ThemeREX Cobble theme up to and including version 1.7. Any WordPress installation that has not upgraded beyond 1.7 and has the theme active is susceptible. No other versions or products are listed as affected.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not yet listed in the CISA KEV catalog. Because the attack requires direct access to the theme’s include mechanism, an attacker needs a path to influence the filename parameter, which is typically available only to users with administrative privileges or through a public-facing form that accepts file names. The potential impact includes code execution and data exposure, making the vulnerability a serious threat if the conditions are met.