The LabtechCO theme incorrectly handles filenames in its PHP include/require calls, allowing a local file inclusion flaw. An attacker who can influence the filename parameter may cause the server to read or execute arbitrary files, exposing sensitive information or enabling remote code execution. The weakness is classified as CWE-98.

This issue affects all installations of the LabtechCO theme from its earliest release through version 8.3. Site owners using any of these versions are at risk if the theme is active on their WordPress site.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a currently low probability of exploitation, and it is not listed in the CISA KEV catalog. Exploitation would require the attacker to supply a manipulated filename via a user‑controllable input—such as a query parameter or form field—within the theme’s code that is passed directly to the include/require function. The impact could range from data exfiltration to full site compromise, depending on the files accessed.