Improper control of the filename used in a PHP include/require statement creates a local file inclusion flaw in the Edge‑Themes Belletrist WordPress theme. An attacker could supply a path that references sensitive or executable files on the server, leading to the execution of code or disclosure of application secrets. The weakness is represented by CWE‑98, which describes insecure management of filenames in file inclusion mechanisms.

WordPress sites that use the Edge‑Themes Belletrist theme version 1.2 or earlier are affected. The issue exists from the earliest available version through the current 1.2 release. No specific patch version is listed, so any upgrade to a version newer than 1.2 removes the vulnerability.

The CVSS score of 8.1 indicates a high severity assessment, yet the EPSS score is < 1%, suggesting a low current exploitation probability. Because the flaw is a local file inclusion, it requires the attacker to be able to inject a file path into the application’s include logic; the attack vector is likely via a web request that manipulates a parameter. The vulnerability is not listed in the CISA KEV catalog, so no public exploit must be known. Nonetheless, the high severity and potential for code execution make the risk significant for sites that have not upgraded the theme.