The flaw is an improper control of filenames for include/require statements, allowing an attacker to supply a crafted path that causes the theme’s PHP code to read arbitrary local files. If the attacker can influence the included content to contain PHP code, local file inclusion can lead to remote code execution. The weakness corresponds to CWE‑98 and can compromise both confidentiality and integrity of the WordPress site.

ApusTheme Homeo for WordPress, versions from the initial release through 1.2.59 are affected.

With a CVSS score of 7.5 the vulnerability is high severity, yet its EPSS score of less than 1% indicates a low probability of real‑world exploitation. The issue is not listed in CISA’s KEV catalog. An attacker would need web access to the site and can trigger the inclusion of arbitrary local files by manipulating URL parameters. Successful exploitation would execute code with the web server’s privileges, potentially allowing full site compromise.