Improper control of the filename for include/require statements in the Holmes theme allows an attacker to trigger a local file inclusion vulnerability. An attacker could read arbitrary files on the server or, if the server permits it, execute PHP code, potentially leading to full compromise of the site.

WordPress installations that use the Mikado-Themes Holmes theme, versions up to and including 1.7. Any site that has not updated beyond 1.7 is susceptible.

The CVSS score of 8.1 indicates a high severity. The EPSS score of < 1% reflects a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves exploitation of a local file inclusion point, which may be triggered by a crafted request or a logged‑in user with access to the affected theme’s include mechanisms. Successful exploitation could lead to a breach of confidentiality, integrity, or availability of the WordPress site.