Improper control of the filename used in PHP's include/require statement in the Le Truffe theme enables a local file inclusion flaw. An attacker could supply a crafted request to load arbitrary files from the server, potentially exposing sensitive configuration files or injecting and executing malicious PHP code. This vulnerability is identified as CWE‑98 and can lead to severe compromises of confidentiality, integrity, and availability.

The issue affects the ThemeREX Le Truffe WordPress theme for all versions up to and including 1.1.7. Any WordPress installation that has installed this theme remains vulnerable until the theme is updated to a version that removes the vulnerable include logic.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at the moment. The vulnerability has not yet been listed in the CISA KEV catalog. Exploitation requires the ability to craft requests that influence the file parameter used in the include/require call; thus, an attacker with network access to the site and knowledge of the vulnerable endpoint can trigger the flaw. Due to the local nature of the attack it generally needs only the web server’s file system readability, making it potentially effective against servers with relaxed file permissions.