The Craftis theme contains an improper control of filename for include/require statements, enabling a local file inclusion flaw. This flaw permits attackers to request arbitrary files on the server to be read or executed when a crafted request is processed, potentially leading to remote code execution if the application later includes or executes the content. The vulnerability is cataloged as CWE‑98 and rates a high CVSS score of 8.1.

WordPress ThemeREX Craftis, versions from the initial release up through 1.2.8. The issue affects any WordPress site that has the Craftis theme installed at these or earlier versions.

With a CVSS score of 8.1 and an EPSS probability below 1 % in the current exposure model, the technical severity is high but the likelihood of exploitation remains low. Because the flaw is triggered by user-controllable input that causes the theme to include or read local files, an attacker with network-level access to the WordPress site or the ability to inject parameters into the theme’s URL may exploit it. The lack of listing in the CISA KEV catalog suggests no widespread public exploits have been observed yet, but the local file inclusion potential warrants immediate action to prevent possible remote code execution.