Improper control of the filename used in PHP include/require statements in the Kutethemes Biolife WordPress theme allows an attacker to specify a local file path. This flaw, classified as CWE‑98, can enable the reading of arbitrary files on the server, such as wp‑config.php or other sensitive configuration files, potentially exposing credentials or server configuration information. The impact is primarily confidentiality and integrity compromise; the CVE description does not explicitly state code execution or full site takeover.

The vulnerability affects all installations of the Kutethemes Biolife theme from its first release through version 3.2.3. Any WordPress site that has not upgraded beyond that version is considered at risk.

The CVSS base score of 7.5 places this issue in the high severity range, while the EPSS probability is reported as less than 1%, indicating a low likelihood of widespread exploitation at present; it is not listed in the CISA KEV catalog. The likely attack vector is a web-based request that includes a file path parameter, as this flaw can be triggered by an unauthenticated attacker who can craft a request to the vulnerable script. Once the attacker controls the file path, they can read sensitive local files, and if the site allows file uploads or execution of uploaded PHP, further compromise may be possible. Because access to the vulnerable theme files is the minimal prerequisite for exploitation, the risk remains significant for affected sites.