The Metro WordPress theme contains an improper control of filename for include/require statements, a local file inclusion flaw. This allows an attacker to manipulate the path parameter so that the theme reads and executes files from the local server file system. Successful exploitation can grant the attacker remote code execution and compromise the confidentiality, integrity, and availability of the WordPress site.

All installations of the RadiusTheme Metro theme version 2.13 and earlier are affected. Sites using those versions are exposed, while releases newer than 2.13 are considered safe.

The CVSS score of 8.1 indicates high severity, whereas the EPSS score of < 1% suggests a low current exploitation probability. The vulnerability is not listed in the KEV catalog, implying no publicly documented attacks. The most likely attack vector is a crafted HTTP request that supplies a tampered file path to the theme’s include logic, enabling the server to read and execute arbitrary PHP code.