WordPress theme Foodie contains an improper control of filenames used in PHP include/require statements. The flaw allows a local file inclusion attack that can read sensitive files or execute malicious code. The vulnerability falls under CWE-98, exposing information confidentiality and potentially enabling complete compromise of the hosted site.

The affected product is the ThemeREX Foodie WordPress theme version 1.14 and earlier. No specific patch version is listed beyond the mention that versions from n/a up to 1.14 are impacted.

The CVSS score of 8.1 indicates a high severity level, but the EPSS score of less than 1% shows that exploitation is currently considered unlikely on a broad scale. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a request that influences the include path, most likely exploiting a publicly exposed parameter in the theme’s PHP code. The lack of an official workaround means that the best mitigation is to update to a fixed version or apply hosting precautions.