Unauthenticated Local File Inclusion in WordPress AutoParts theme versions up to 1.5.8 allows attackers to arbitrary files from the server. The flaw arises from unsanitized input that is used in a file inclusion context, leading to potential disclosure of sensitive data such as configuration files or user credentials. This weakness is identified as CWE‑98 and could let an attacker gain additional insight into the site’s configuration or environment.

ThemeREX:AutoParts theme in WordPress installations running version 1.5.8 or earlier.

The CVSS score of 8.1 indicates a high‑severity vulnerability, and the lack of an EPSS score means the exploitation probability is not currently quantified. The vulnerability is not listed in CISA KEV, but it can be triggered by any unauthenticated user as LFI is local and does not require privileged access. The attack vector is inferred to be a direct parameter manipulation in the URL that is not properly validated.