This vulnerability arises from improper control over file names used in PHP include/require statements within the Verse theme. The flaw allows an attacker to instruct the theme to include arbitrary files, which can lead to reading sensitive files or executing malicious code on the server. The weakness is classified as CWE‑98, indicating insecure handling of file paths.

WordPress users running the Verse theme from ThemeREX, specifically any installation using version 1.7.0 or earlier. No specific release dates are given, but the issue applies to all releases up to and including 1.7.0.

The vulnerability carries a CVSS score of 8.1, reflecting high severity. EPSS indicates exploitation probability is below 1 %, suggesting that attacks are unlikely to be widespread but still possible. The flaw is not listed in the CISA KEV catalog. Although the description does not state the attack vector explicitly, the nature of the issue implies that a remote web attacker can trigger the inclusion via crafted input to the theme’s processing logic. Proper permission controls and the absence of a relevant workaround increase the risk to systems that have not applied the patch.