The ThemeMove Unicamp WordPress theme contains an improper control of filename for include/require statements in PHP. Attackers can manipulate the include path to read or execute arbitrary files on the server, potentially leading to data disclosure or remote code execution. The weakness corresponds to CWE‑98. The impact is significant, as it grants attackers access to local files and may allow further exploitation of the web application.

All installations of the Unicamp theme provided by ThemeMove, versions from the earliest available release through 2.7.1, are affected. This includes any WordPress site that has not updated beyond version 2.7.1.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is less than 1%, indicating a low but non‑zero probability of exploitation. It is not currently listed in the CISA KEV catalog. Exploitation requires a web request containing a forged include path; attackers do not need additional privileges. The underlying weakness is the lack of input validation for include/require paths, enabling local file inclusion.