The Coleo theme for WordPress does not validate the filename used in PHP include or require calls, allowing a local file inclusion flaw. An attacker who can supply an arbitrary file name may cause the server to read or include sensitive files, exposing configuration data or other secrets. This weakness is classified under CWE‑98.

ThemeREX Coleo theme version 1.1.7 and all earlier releases are affected on all WordPress installations that use this theme. Sites that host the Coleo theme should verify the version in use.

The CVSS score of 8.1 indicates high severity. The EPSS score is below 1%, suggesting that exploitation activity is currently low and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is a local file inclusion that could be triggered when a user‑supplied file path is passed to an include or require statement without proper validation. If an attacker is able to provide that file path, they could read arbitrary files from the server, leading to potential disclosure of sensitive information.