The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, classified as a PHP Local File Inclusion flaw that permits an attacker to read or execute arbitrary files on the server. It resides in the Welldone theme’s inclusion logic and is identified as CWE‑98. A successful exploitation could expose sensitive configuration data or enable remote code execution, and the flaw carries a CVSS‑3.1 score of 8.1.

All installations of the Welldone WordPress theme up to and including version 2.4 are affected. This includes every release from the initial launch up to the stated maximum version, as the vulnerability exists whenever the theme processes include parameters without proper validation.

The EPSS score for this vulnerability is below 1 %, and it is not listed in CISA’s KEV catalog, indicating minimal exploitation activity to date. Based on the description, the likely attack vector is a web request that allows the attacker to craft a parameter that the theme uses in a require or include statement, often via a URL or form submission. The flaw does not require privilege escalation, and a successful attack could read sensitive files, inject malicious PHP code, or otherwise compromise the confidentiality, integrity, and availability of the WordPress installation.