The Don Peppe WordPress theme contains an improper control of filename in a PHP include/require statement, allowing an attacker to supply a crafted filename. This local file inclusion flaw can enable reading of arbitrary files on the server, and if a relevant file is included and executed, it may lead to execution of arbitrary PHP code. The vulnerability’s high CVSS score reflects the severity of the potential impact, which includes loss of confidentiality, integrity, and availability of the web application.

All releases of the Don Peppe theme up to and including version 1.3 are affected. This includes any WordPress site that has installed the theme at or below that version.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently considered low probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web application, where an attacker can manipulate query parameters or input that controls the include path. Successful exploitation requires no special privileges beyond a web request; if the attacker gains the ability to trigger the vulnerable include, the local file can be read or executed remotely.