Unauthenticated Local File Inclusion exists in versions of the Backhoe theme up to 2.0. An attacker may craft a request that causes the theme code to read or exfiltrate any file stored on the web server, potentially revealing sensitive configuration data, credentials, or user information. The weakness is identified as CWE‑98, which directly models file inclusion flaws that can be abused to read or modify files on the server.

The Backhoe theme by Mymoun, all releases with version numbers 2.0 or lower, are affected. No other versions or products are known to be impacted according to the current advisory.

The vulnerability carries a CVSS score of 8.1, indicating high severity. No EPSS score is available, so the current model of exploitation probability is unknown, but the lack of an authentication requirement makes it trivial for an attacker who can craft the request. The vulnerability is not listed in CISA KEV; however, its high severity and the possibility to obtain any file on the server make it a serious risk. Due to the lack of authentication, the attack vector is likely local or via a crafted URL containing an unsafe path traversal loop.