The vulnerability arises from improper control of the filename used in a PHP include/require statement within the NeoBeat theme. Because the filename originates from user input, an attacker can force the theme to include arbitrary files from the server’s file system, exposing sensitive configuration files or enabling the execution of malicious scripts. This local file inclusion can compromise confidentiality and, if combined with other weaknesses, may allow remote code execution.

Elated‑Themes NeoBeat WordPress theme, versions up to and including 1.2, installed on any WordPress site that uses this theme.

The CVSS score of 8.1 indicates significant severity, while the EPSS score of less than 1% shows that exploitation in the wild is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation can be carried out remotely by manipulating HTTP requests that trigger the vulnerable include/require logic, so a remote attacker only needs network access to the WordPress site.