The Eona theme contains an error that allows the inclusion of filenames from user input without proper validation. This flaw enables an attacker to read any file that the web process can access, potentially exposing sensitive data or files that may be used later for further compromise. Because the inclusion occurs in PHP code, a malicious file could also be executed, turning the vulnerability into a code‑execution risk under the right conditions.

Mikado‑Themes’ Eona theme, any release up through version 1.3. No specific sub‑version has been exempted; all files previous to the fix are affected.

The CVSS score of 8.1 signals a high-severity weakness, while the current EPSS of less than 1% indicates that active exploitation is not widespread at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known, widely‑used exploit. Likely, an attacker must supply a crafted request to the theme that triggers the vulnerable include, exploiting the lack of filename sanitization. The threat is confined to the web server hosting WordPress, but the data exposed or code executed could affect the entire host.