The Deston theme for WordPress includes a PHP file inclusion mechanism that does not validate or sanitize the filename used in an include/require statement. This omission allows attackers to cause the application to include arbitrary local files, which may lead to arbitrary PHP code execution. The weakness corresponds to CWE‑98.

The flaw exists in the Deston theme by Mikado‑Themes for WordPress, affecting every release up to and including version 1.0. Any site that currently uses one of those releases and does not apply a patch is potentially vulnerable.

The CVSS score of 8.1 places this issue in the high‑severity range. EPSS indicates a very low probability of exploitation (< 1 %) and the vulnerability is not yet catalogued in the CISA KEV list. Successful exploitation would require the ability to send a request that triggers the unsanitized include, so the attack vector is inferred to be local or remote depending on the theme’s exposure. Once triggered, the attacker could read or execute code, compromising confidentiality, integrity, and availability of the affected site.