Freshio theme v2.4.2 and earlier contain an improper validation of include/require filenames in the PHP code. The flaw can allow an attacker to manipulate the file path used in an include statement, causing the server to include unintended files. An attacker who can control the path parameter may read local files or, if the server allows remote file fetching, execute arbitrary PHP code. The vulnerability is classified as CWE‑98, which indicates uncontrolled or invalid file inclusion.

WordPress installations that use the Freshio theme from the vendor Pavothemes. All theme releases up to and including version 2.4.2 are affected; newer versions (2.4.3 and later) are not.

The CVSS score is 7.5, denoting a high severity. EPSS is reported as less than 1 %, suggesting that known exploitation attempts are rare, but the presence of the flaw provides a clear attack path that requires only local knowledge of a vulnerable script or a parameter that accepts the file path. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited. However, the nature of the flaw makes it a high-value target for attackers who can redirect the include to sensitive files or to remote payloads. Accordingly, this vulnerability carries a high risk that could lead to data disclosure or remote code execution.