Improper control of file names in PHP include/require statements allows attackers to trigger local file inclusion in the Bonbon WordPress theme. The flaw, identified as CWE‑98, could enable an attacker to execute arbitrary PHP code on a vulnerable site if a crafted file path can be supplied. The vulnerability is described as a PHP Remote File Inclusion issue that operates as local file inclusion, jeopardizing the confidentiality, integrity, and availability of the affected WordPress installation.

The ThemeREX Bonbon WordPress theme is affected. All versions up through 1.6 are vulnerable; no later version information is provided.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS rating of less than 1% suggests that exploitable incidents are relatively rare, yet the flaw can be leveraged in a local context if an attacker can influence file inclusion paths. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local file inclusion driven by unsanitized inputs in the theme’s PHP code, potentially requiring local access or a path traversal capability to abuse the flaw.