The Triply theme for WordPress contains an improper control of filename for include/require statements, allowing a local file inclusion (LFI) vulnerability. An attacker could craft a request that causes the PHP code to include a user‑supplied file path, potentially reading sensitive files or executing PHP code that resides on the server. This flaw is rooted in CWE‑98 and can result in information disclosure and, in some instances, execution of code that was uploaded to the site.

Any WordPress site running pavothemes Triply version 2.4.7 or earlier is affected. The vulnerability applies to all releases from the earliest version through 2.4.7 inclusive, while installations that have upgraded beyond 2.4.7 are not impacted by this specific flaw.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a web request that manipulates an inclusion path in the PHP code. An attacker with network access to the web server or the ability to influence user‑controlled parameters could exploit this flaw by appending a path traversal sequence to a query parameter the theme uses to include files. No additional preconditions beyond normal web access are required.