The Kitchor theme has an improper control of the filename used in a PHP include/require statement, allowing an attacker to influence the path of the file that is loaded. This flaw can enable a local file inclusion, which may expose the contents of files stored on the server such as configuration files, user data, or even allow further code execution if the included file contains malicious payloads. The vulnerability is identified as CWE‑98.

Themelexus Kitchor theme version 1.4.3 and earlier. Any installation using these or earlier versions of the theme is vulnerable because the code performs include/require operations without sanitizing the filename supplied to the request.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% denotes a low probability of exploitation at present. The flaw has not been observed in the CISA KEV catalog. Since the vulnerability permits inclusion of arbitrary local files, an attacker who can manipulate the inclusion file contents may target local system files. The attack vector is inferred to be local, likely via file path.