The Prowess theme for WordPress contains an improper control of filenames used in include/require statements that enables local file inclusion. This flaw, classified as CWE-98, allows an attacker to cause arbitrary local files on the server to be read or executed within the context of the web application. The primary impact is the exposure of sensitive information or execution of unintended code, which could compromise the confidentiality, integrity, or availability of the site. The CVSS score of 9.8 indicates a high severity vulnerability.

The vulnerability is present in all releases of the Select‑Themes Prowess theme up to and including version 2.3. Any WordPress site that has Prowess 2.3 or an earlier version installed is affected. No specific patch version is provided, so the recommended action is to upgrade to a version newer than 2.3 if one exists or to remove the theme entirely.

With a score of 9.8 the risk level is high, yet the EPSS score of less than 1% suggests that active exploitation is currently low. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to involve an attacker influencing the data that determines the include path, such as through a manipulated query parameter or theme configuration option, to specify a local file. Successful exploitation requires the attacker to influence the server so that the include statement resolves to an arbitrary file.