The Bazinga theme for WordPress contains a PHP include/require call that accepts a filename directly from user input without any validation. This flaw, classified as CWE‑98, permits a local file inclusion (LFI). An attacker can cause the theme to include any file the web server can read, potentially exposing sensitive configuration files, database credentials, or other confidential data. Because the LFI is executed within the context of the full WordPress installation, the consequences can affect confidentiality, integrity, and availability of the site.

The vulnerability affects all versions of ThemeREX Bazinga from the first release up through version 1.1.9. WordPress sites that currently use these versions are vulnerable; no specific PHP or operating‑system requirement is cited, so the issue applies to any environment running the affected theme.

The issue scores an 8.1 on the CVSS scale, indicating high severity. The EPSS score of <1% suggests that exploitation in the wild is currently rare, and the vulnerability is not tracked in the CISA KEV catalog. The likely attack vector is an attacker crafting a URL or form input that injects an arbitrary file path, causing the theme to include the targeted file. Exploitation requires only that the attacker control the input; no additional privileges or pre‑conditions are indicated.