Technical impact
An unauthenticated local file inclusion vulnerability exists in the WordPress theme Måne in versions 1.7 and earlier. The theme fails to validate file path parameters before including them, granting an attacker the ability to specify arbitrary file paths that the theme will read. This can expose sensitive configuration data, or if a PHP file is served, may lead to code execution (this is inferred from typical LFI behavior). The weakness is identified as CWE‑98.
Affected Systems
The vulnerability affects the WordPress theme Måne from Elated‑Themes. Any site that has installed version 1.7 or earlier is impacted. Versions newer than 1.7 are not listed as vulnerable.
Risk and Exploitability
The flaw has a high CVSS score of 8.1, indicating a significant potential impact on confidentiality and integrity. No EPSS score is provided, and it is not listed in the CISA KEV catalog, so the current exploitation prevalence is unknown. The description indicates that the vulnerability can be triggered by an unauthenticated user via crafted HTTP requests that supply a malicious file path; the attacker must determine a valid file that can be read or executed by the WordPress code.
