The FlashMart WordPress theme contains an improper control of the filename used in PHP include/require statements, a flaw classified as CWE‑98. This vulnerability allows an attacker to request that the application include arbitrary local files. If the attacker can force the inclusion of PHP files or files that can be executed, the impact could range from disclosure of sensitive configuration files to remote code execution. The upper‑layer operating system and application files become read‑or‑executed accessible, thereby compromising confidentiality, integrity, or availability of the affected site.

The vulnerability affects all releases of the FlashMart theme from the first known version up to and including version 2.0.15. No higher releases of the FlashMart theme are listed as affected.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests that, at the moment of this analysis, the likelihood of the vulnerability being exploited is very low. It is not listed in the CISA KEV catalog. The attack vector is inferred to be via crafted input to the theme’s PHP code that determines the file path for an include/require statement, possibly through a URL parameter or form field. Successful exploitation would require that the attacker can influence the string supplied to the include/require call and that the target application runs with a web server user that has read access to the targeted files.