The Edge‑Themes Overworld theme contains an improper control of filenames used in PHP include/require statements, which creates a local file inclusion vulnerability. An attacker who can send a crafted request may force the theme to include an arbitrary file from the server’s filesystem. This could expose sensitive configuration files, reveal system information, or enable execution of malicious code if the included file also contains executable PHP. The weakness is classified as CWE‑98: Improper Control of Filename for Include/Require Statement.

Edge‑Themes Overworld theme versions from the initial release through 1.5 are affected. Any WordPress site deploying Overworld 1.5 or earlier must review their installations and apply changes.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% shows a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors are remote, where an attacker crafts a request that manipulates the include path. Successful exploitation requires that the target server’s web root contains readable or writable files that an attacker can coerce the theme to load. If an arbitrary PHP file is included, the attacker could achieve remote code execution, compromising confidentiality and integrity of the application and underlying system.