The Billey WordPress theme includes an improper control of filenames supplied to PHP include or require statements, creating a local file inclusion (LFI) flaw (CWE-98: Improper Control of Filename for Include/Require Statement). This vulnerability could allow an attacker to read arbitrary files on the web server or, if a malicious file is included, execute arbitrary PHP code, thereby compromising the confidentiality, integrity, and availability of the site.

All WordPress websites that have ThemeMove Billey installed with a version of 2.1.8 or earlier are affected. Any site that activates or maintains the Billey theme within its 2 release series is at risk.

The CVSS base score of 7.5 indicates a high severity vulnerability. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog. The likely attack vector is through the web interface of an affected WordPress site, where an attacker could supply a crafted filename to the vulnerable include/require call. Successful exploitation can lead to file disclosure or remote code execution, depending on the file selected and the permissions of the web server process.