The OsTende theme for WordPress contains an improper control of the filename used in PHP include/require statements, allowing a local file inclusion flaw. An attacker can supply a crafted path that causes the application to read arbitrary files on the server. If a writable location contains PHP code, that code could be executed with the privileges of the web server. The vulnerability is identified as CWE‑98.

WordPress sites running ThemeREX's OsTende theme version 1.4.3 or earlier are affected. The flaw exists in all releases from the first release through 1.4.3, as the vulnerable code path is present in each of those versions.

The CVSS score of 8.1 indicates a high severity impact, while the EPSS score of less than 1% reflects a very low current exploitation probability. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request that supplies a malicious file path; the local file inclusion flaw creates an opportunity for an attacker to read sensitive configuration files or, if the server permits PHP execution from arbitrary locations, to run code with the web server’s privileges. Overall, the risk is high but the likelihood of exploitation at present is low.