This vulnerability enables an unauthenticated attacker to include arbitrary local files in the Flipmart WordPress theme through manipulation of request parameters. Because the vulnerable code path does not enforce authentication checks, the attacker can read any file accessible to the web server, potentially exposing configuration files, database credentials, or other sensitive data. The weakness is included by default in the theme, so it is exposed immediately to all visitors.

The issue affects the CKThemes Flipmart WordPress theme in versions 2.8 and below. Users operating any of these versions are exposed until an updated release is applied.

The CVSS base score of 8.1 classifies the flaw as high severity, indicating significant potential damage if exploited. The EPSS score is not provided, so the current exploit probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger this flaw by sending a crafted URL or form submission that directs the theme’s file inclusion logic to a target file. No special privileges or authentication are required, making it trivial for a wide range of threat actors to initiate an attack.