The vulnerability in jwsthemes IdealAuto results from an uncontrolled use of user input in an include/require statement, allowing Local File Inclusion. An attacker can supply a crafted path in the request, causing the theme to read arbitrary files from the server. This exposure can lead to the disclosure of sensitive files and, on some server configurations, execution of code. The weakness is classified as CWE-98. The entry’s description confirms the flaw permits PHP Local File Inclusion.

Affected products include the IdealAuto theme for WordPress from any version up to, but not including, 3.8.6. The vendor jwsthemes has not specified a patch in the provided references and control is required for versions prior to 3.8.6.

The CVSS score of 8.1 indicates a high severity vulnerability, with an EPSS score below 1% suggesting low current exploitation probability. The defect is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw through a web request that references the vulnerable parameter, making remote exploitation possible. Admins should prioritize patching, as failing to mitigate could allow attackers to read sensitive information or potentially run code on the server.