The Equadio theme contains a flaw where user-controlled data can be passed directly to a PHP include/require statement without proper validation or sanitization. This improper control of the filename field enables an attacker to read or execute malicious files on the server, potentially giving them the ability to run arbitrary code or access restricted files.

The vulnerability is found in the ThemeREX Equadio theme, affecting all releases from the earliest available version up to and including version 1.1.3. No additional version ranges are specified in the advisory, so any installation of Equadio 1.1.3 or older is potentially insecure.

The reported CVSS score of 8.1 categorizes it as High severity. The EPSS score of less than 1% indicates that, as of the latest assessment, the probability of exploitation is low, and it has not been listed in the CISA KEV catalog. However, because the flaw permits local file inclusion, a compromised WordPress installation could be leveraged to execute arbitrary scripts if an attacker controls the server’s filesystem or can supply a path that resolves to a dangerous file.