This vulnerability allows an attacker to include arbitrary local files in PHP scripts by controlling the filename passed to an include/require statement. The flaw arises from improper validation of the filename, making it possible to expose sensitive configuration files or other data. The issue is classified as CWE‑98 and can lead to confidentiality compromise if exploited.

The QantumThemes Kentha Elementor Widgets plugin for WordPress is affected. All releases from the initial version up through 3.0 contain the vulnerability. Versions 3.1 and later incorporate the necessary fix.

The CVSS base score is 7.5, indicating a moderate‑to‑high impact. The EPSS score is below 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a crafted web request that manipulates the include/require parameter, enabling directory traversal and reading of local files. The attack does not require elevated privileges beyond the web application context.