The vulnerability arises from improper validation of filenames used in PHP include or require statements within the Leedo theme, classified as CWE‑98. This flaw permits an attacker to supply arbitrary local file paths that are interpreted by the PHP engine. Based on the description, an attacker could cause the theme to load and parse any file that the web server process can read, and if the injected file contains executable PHP code, remote code execution may be achieved. The advisory does not confirm remote code execution, so this consequence is inferred rather than explicitly stated.

All releases of the VLThemes Leedo theme from the earliest available version up through 3.0.0 are affected. Anyone running one of these releases on a WordPress installation is potentially vulnerable until the theme is upgraded beyond 3.0.0.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a crafted HTTP request that passes a malicious file path to the theme’s include logic, allowing the attacker to read any file accessible to the web server, and possibly trigger code execution if the file contains PHP code.