The Kaven theme for WordPress contains an unauthenticated local file inclusion flaw that allows an attacker to read arbitrary files on the server. Unsanitized file path input leads to disclosure of configuration files, credentials, or code, directly impacting confidentiality and providing a foothold for further compromise. The vulnerability is identified as CWE‑98 and enables attackers to access files that should be protected.

All installations of the Kaven theme version 1.2 or earlier released by CocoBasic are impacted. WordPress sites that have not upgraded past version 1.2 remain exposed to this flaw.

The CVSS score of 8.1 indicates high severity; an attacker can readily obtain confidential information or set the stage for privilege escalation. The EPSS score is not available, but local file inclusion weaknesses are frequently exploited in practice, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a crafted request that supplies an unsanitized file path to the theme’s LFI handler, requiring no authentication or elevated privileges.