WordPress TechOne theme versions up to 3.0.3 contain an unauthenticated local file inclusion flaw that allows an attacker to supply a path and cause the theme to read or execute files on the server. A successful exploitation could expose sensitive configuration files, user data, or lead to remote code execution if an attacker controls the content of the included file.

KuteThemes TechOne theme for WordPress, versions 3.0.3 and earlier.

The vulnerability carries a high CVSS score of 8.1. No EPSS data is available, and it has not been listed in the CISA KEV catalog. Because the flaw is unauthenticated and relies on a user-supplied file path, an attacker only needs to send a crafted request to the vulnerable endpoint, making it relatively easy to abuse if the target is exposed to the internet.