This vulnerability arises from improper control of the filename used in an include/require statement within the Avventure WordPress theme, exposing it to local file inclusion. An attacker who can influence the filename can read arbitrary files on the server and potentially trigger execution of those files via PHP. The flaw corresponds to CWE-98, which is an improper input handling weakness that permits inclusion of unintended files.

The issue applies to WordPress installations using the ThemeREX Avventure theme up to and including version 1.1.12. Any site that has installed this theme version or an earlier release is exposed to the flaw.

With a CVSS score of 8.1 the vulnerability is considered high severity, and the EPSS score of less than 1% indicates that exploitation attempts are uncommon. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, an attacker might exploit the flaw by manipulating the theme’s filename parameter, for example via a crafted URL or form input, to trigger the vulnerable include. The effectiveness of such an attack depends on the site’s exposure to external traffic.