The Emaurri WordPress theme validates user input incorrectly in a PHP include/require statement, allowing arbitrary filenames to be supplied. By controlling this filename, an attacker can include files from the server’s filesystem. This can expose configuration files or source code, and if the attacker can place malicious PHP files in an accessible location, they may achieve remote code execution with the web server’s privileges.

All installations of the Mikado‑Themes Emaurri theme version 1.0.1 or earlier are vulnerable. Versions prior to this are not known to be affected. Any WordPress site using a susceptible theme is at risk.

The flaw carries a CVSS score of 8.1, indicating high severity, yet the EPSS score is below 1%, meaning real‑world exploitation is currently unlikely. The vulnerability is not catalogued in CISA’s Known Exploited Vulnerabilities. The likely attack vector requires the attacker to influence the filename used in the include statement, which can be inferred to be achieved through the theme’s public interfaces or via another vulnerability that permits arbitrary file upload or manipulation. Successful exploitation could lead to arbitrary file read or execution of code with web server permissions.