Unauthenticated Local File Inclusion is present in WordPress Ozeum theme versions up to 1.3.0. This weakness allows an attacker to direct the theme to read or execute local files on the web server, potentially leaking sensitive information or executing malicious code. The flaw can be leveraged to read configuration files, credentials, or arbitrary system files, and in conjunction with other flaws, may lead to full code execution. The vulnerability is classified as CWE-98 and carries a CVSS score of 8.1, indicating a high severity impact on confidentiality, integrity, and availability.

The Ozeum theme by ThemeREX for WordPress, versions 1.3.0 and earlier, is affected. Users of these theme versions must verify their installation and upgrade or replace the theme to eliminate the risk.

The CVSS score of 8.1 reflects that the vulnerability has a high exploitation potential. No EPSS score is provided, but the lack of availability information does not mean the flaw is unexploitable; attackers can exploit it via crafted requests. The issue is not listed in the CISA KEV catalog, yet its unauthenticated nature makes it a priority for remediation. The likely attack vector is via a URL that triggers the theme’s file inclusion routine, and because authentication is not required, any web visitor can mount the attack.