Improper control of filenames in the include/require statements of the Aldo theme allows a local file inclusion attack. An attacker who can influence the file path used by the theme could cause the site to read arbitrary files from the server, and depending on file types, may execute PHP code. This leads to potential disclosure of sensitive data, tampering with configuration files, and remote code execution if the attacker can supply a file containing PHP code.

The vulnerability exists in the Aldo theme by ThemeREX for WordPress. Any installation using version 1.0.10 or earlier is susceptible. No higher versions are indicated as affected.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send a crafted request to the WordPress site with the vulnerable theme, likely manipulating query parameters that the theme uses for file paths. Because it is a local file inclusion, the success of the attack depends on the file system layout and the permissions of the web server process.