An unauthenticated local file inclusion flaw exists in Theme Test Drive WordPress plugin versions up to 2.9.1. The plugin allows any user to supply a file path through a request and the server will include the file. This can expose sensitive files such as configuration or credential files stored on the server. If the included file is a PHP script, an attacker could potentially execute code, but the description does not confirm this outcome.

Plugins created by Vladimir Prelovac with a name of Theme Test Drive, in any WordPress site running version 2.9.1 or older, are affected. Versions newer than 2.9.1 are not reported as vulnerable, so upgrading the plugin should remove the issue.

The CVSS base score of 8.1 signals a high severity vulnerability. The EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. Because authentication is not required and the plugin entry point is publicly accessible, the likelihood of exploitation is non‑negligible. The impact is inferred to potentially allow read access to arbitrary files; execution of arbitrary PHP code is possible only if the attacker can craft a request that includes a PHP file, but the description does not confirm that vulnerability can be used directly for code execution.