An improper control of filename used in PHP include/require statements in the jwsthemes StreamVid theme allows a local file inclusion flaw. This weakness enables an attacker to read arbitrary files on the server and, if the included file can be overwritten, to execute code with the web server’s privileges. The vulnerability is classified as CWE‑98 and carries a high CVSS score of 8.1, indicating significant risk to confidentiality, integrity, and availability.

All WordPress installations that use the StreamVid theme by jwsthemes and run any version earlier than 6.8.6 are affected. The risk applies from the earliest release of the theme through to 6.8.5, meaning that any site that has not upgraded to 6.8.6 or later remains vulnerable.

The CVSS score reflects a high severity level, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote; an attacker can exploit the flaw by crafting a request that manipulates the filename used in an include/require statement, possibly via URL parameters or form inputs. If unauthenticated access is possible, the attacker may read sensitive configuration files or, with write permissions, upload and execute arbitrary code.