Improper control of filename in an include/require statement allows an attacker to include local files via the Feedy WordPress theme, potentially enabling the reading of sensitive files and execution of arbitrary PHP code if a suitable local path can be supplied. The primary impact is the compromise of data confidentiality and the potential elevation of privilege to execute code on the server. This weakness is a classic file‑inclusion flaw, identified by CWE‑98.

The vulnerability affects all instances of the jwsthemes Feedy theme running any version prior to 2.1.5. Versions 2.1.5 and newer are not impacted.

With a CVSS score of 8.1 the flaw is of high severity, yet the EPSS score of under 1% suggests it has not yet been widely exploited; it is also not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to trigger the vulnerable include via the theme’s web interface, and there is no evidence this can be triggered remotely. The risk can be mitigated by applying the official patch or disabling the theme.