An improper control of the filename used in an include/require statement in the Mixtape theme allows an attacker to supply a crafted filename that bypasses normal path restrictions. The flaw can cause the theme to include arbitrary local files on the server, potentially exposing sensitive data or executing arbitrary PHP code if local scripts are included. This compromise falls under the Local File Inclusion weakness (CWE‑98).

WordPress sites using the Select‑Themes Mixtape theme are affected. Versions from the initial release through and including 2.1 contain the vulnerability; no later version has been identified as affected. Sites that have upgraded to 2.2 or newer are not impacted.

The CVSS base score is 8.1, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It can be exploited by delivering a specially crafted request that controls the filename argument in the theme’s include logic, typically from a public‑facing page. Successful exploitation permits reading privileged files or executing PHP code, granting attackers significant control over the affected server.