CocoBasic’s Fabius WordPress theme through version 1.0 contains an unauthenticated Local File Inclusion flaw. The vulnerability allows an attacker to request arbitrary files from the web server, potentially exposing sensitive configuration data, credentials, or other confidential information. The weakness is a classic file inclusion flaw (CWE‑98) and does not grant immediate code execution but can be leveraged to acquire data that may aid further attacks.

The issue affects all installations of the CocoBasic Fabius theme with a version of 1.0 or earlier. Users running any released build of the theme without upgrading beyond 1.0 are vulnerable and should verify the exact theme version in use.

The CVSS score of 8.1 indicates a high severity vulnerability. Exploitation requires no authentication, so any user who can send requests to the site may trigger the flaw. The EPSS score is not available, but the lack of a KEV listing suggests no widespread public exploitation at the time of analysis. Attackers could use the flaw to read sensitive files locally on the server, potentially stepping into a larger compromise if additional weaknesses exist.