The Mane theme for WordPress contains a local file inclusion flaw in all releases up to version 1.7, allowing attackers to load and execute arbitrary PHP files on the server. This vulnerability is described by CWE-98, and it can lead to full compromise of the site, including bypassing authentication, retrieving confidential data, or running arbitrary code that an unauthenticated user could supply. The impact is thus critical, as it grants the attacker administrative control over the affected installation.

Any WordPress installation using the Mane theme with a version 1.7 or earlier is affected. Specific version numbers beyond 1.7 are not listed, so any deployment not upgraded past that threshold inherits the flaw. No additional products or vendors are mentioned.

The CVSS score of 8.1 reflects a high severity, and the lack of an EPSS value means the exploitation probability is not quantified, though the exposure is significant because it requires no authentication. The vulnerability is not listed in CISA’s KEV catalog, but the nature of the flaw suggests that a local file inclusion vector could be abused on legitimate uploads. The attacker can upload an ‘image’ file that is actually a PHP script and later reference that file via a parameter that the theme processes, causing the PHP code to run. This inference comes directly from the description of unauthenticated code execution via uploaded image-type files.