An unauthenticated local file inclusion vulnerability exists in the Volos WordPress theme for versions 1.2 and earlier. The flaw allows the inclusion of arbitrary files from the server filesystem when a visitor supplies a crafted file path. Based on the description, it is inferred that the theme does not validate or sanitise input to resolve relative or absolute file paths, enabling an attacker to read sensitive data or execute server‑side code if a suitable file is included. This can expose configuration files, database credentials, or lead to remote code execution if the included file contains executable PHP code.

The affected system is the CocoBasic Volos WordPress theme, versions 1.2 and earlier.

With a CVSS score of 8.1, this vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is the theme’s file inclusion endpoint, which is accessible without authentication; an attacker can supply a crafted file path to read or execute arbitrary files on the server.