The Overton theme for WordPress contains an insecure include/require statement that accepts a filename from user input without adequate validation. This flaw allows an attacker to supply an arbitrary local file path, causing the theme to read or execute that file. The consequences range from leaking sensitive configuration files to running malicious PHP code if the server permits local file inclusion.

The vulnerability affects Mikado-Themes’ Overton theme for WordPress versions up to and including 1.3. Any site running this or earlier versions is vulnerable; releases beyond 1.3 are reported by the vendor to be unaffected.

A CVSS score of 8.1 classifies the flaw as high severity. The EPSS score is less than 1%, indicating that exploitation attempts are rarely recorded, and the issue is not listed in the CISA KEV catalog. Attackers could exploit the vulnerability by crafting a malicious URL that supplies a path to a sensitive file or a malicious PHP script, assuming the server configuration permits local file inclusion. Successful exploitation may enable access to files such as wp-config.php or the execution of arbitrary code within the WordPress context.