An improper filtering of file names in the Laurent WordPress theme allows an attacker to include arbitrary local PHP files via an include/require statement. This local file inclusion flaw, classified as CWE‑98, can permit the reading of sensitive files or the execution of malicious PHP code if a local file that contains executable code is included. The compromised integrity and authenticity of the site could lead to full site takeover, data exposure, and a high‑severity impact.

The vulnerability impacts the Elated‑Themes Laurent WordPress theme, including all releases from the earliest version through version 3.1. Any site running any of those releases remains susceptible until a newer, unprivileged version is installed.

The CVSS score of 8.1 indicates a significant threat, while the EPSS score of less than 1% suggests that automated exploitation is unlikely at present. Still, the flaw can be exploited by an attacker who is able to manipulate the include path—most likely by crafting a URL or request that supplies a local file name in place of an expected value. Local file inclusion may eventually allow remote code execution if the attacker can point the path at a PHP file containing malicious code. The vendor’s advisory recommends upgrading or patching, and the issue is not listed in the CISA KEV catalog.