Improper control of filenames used in PHP include and require statements within the UnTheme OrganicFood WordPress theme creates a local file inclusion flaw. This vulnerability can allow an attacker to read or execute arbitrary files on the server’s filesystem. The potential impact includes unauthorized disclosure of sensitive data or execution of malicious code, thereby compromising the confidentiality, integrity, or availability of the affected WordPress site.

All installations of the UnTheme OrganicFood WordPress theme version 3.6.4 or earlier are impacted. Any WordPress site that has deployed this theme from its earliest release through 3.6.4 remains vulnerable.

The CVSS score of 7.5 classifies the flaw as high severity, while the EPSS score below 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request that manipulates the theme’s file inclusion logic to reference local filesystem paths, a scenario that an attacker would initiate by providing a malicious file path parameter in a request.