This vulnerability is an unauthenticated Local File Inclusion flaw present in the Kutethemes Biolife WordPress theme versions up to 3.2.3. The theme allows an attacker to provide a crafted file path that is passed to the server without proper validation, enabling the request of arbitrary files on the hosting machine. The capability to read sensitive files such as wp‑config.php could expose database credentials and other secrets; however, the CVE payload does not explicitly state that code execution is possible and therefore that potential is not asserted in this report.

WordPress sites that use the Kutethemes Biolife theme version 3.2.3 or earlier are affected. The vulnerability resides solely in the theme code; no other WordPress components are indicated as impacted.

The CVSS score of 8.1 classifies this entry as high severity, indicating significant potential impact if exploited. The EPSS score is not provided, so the short‑term likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying that no publicly documented exploits are known at this time. Based on the description, the likely attack vector is a remote HTTP request directly to the vulnerable theme’s endpoint, where the attacker supplies a crafted file path parameter that the theme passes unsanitized to the server. The lack of authentication requirements suggests that any visitor could trigger the flaw, making the exposure risk particularly broad.