The vulnerability is an unauthenticated Local File Inclusion flaw in the Teoro WordPress theme up to version 1.1. An attacker can supply crafted request parameters that cause the server to read and output arbitrary local files, potentially enabling code execution, data exfiltration or other malicious actions. The weakness corresponds to CWE-98, a common file‑path manipulation issue.

The flaw affects the Teoro theme bundled by CocoBasic, installed on WordPress sites using versions up to and including 1.1. No other variants or plug‑ins are listed.

The flaw has a CVSS base score of 8.1, indicating moderate‑to‑severe impact. EPSS data is unavailable, but the vulnerability is documented as unauthenticated, meaning any user can exploit it via an HTTP request. It is not yet listed in the CISA KEV catalog. Attackers could trigger the LFI by manipulating query parameters or form inputs that the theme passes to file inclusion functions. Because authentication is not required, the risk of exploitation is high for sites still running the affected theme.