An Improper Control of Filename for Include/Require Statement in PHP Program vulnerability allows a local file inclusion attack in the Fuelthemes The Voux theme. The flaw can enable an attacker to read arbitrary files or execute PHP code on the server, potentially leading to data leakage, defacement, or full system compromise. This weakness corresponds to CWE‑98, which describes uncontrolled include or require calls.

Fuelthemes: The Voux theme for WordPress is affected in all releases up to and including version 6.9.5. The vulnerability is present from the earliest version available for the theme through 6.9.5. Site owners using any of those versions are susceptible to exploitation.

The CVSS score of 8.1 indicates a high severity for local file inclusion. EPSS information is unavailable, but the lack of listing in the CISA KEV catalog suggests no known exploits at the time of analysis. The attack vector is inferred to be a remote request to a vulnerable WordPress site that triggers the include/require call with attacker-controlled input, allowing the inclusion of arbitrary local files. Successful exploitation could expose configuration files, credentials, or allow arbitrary PHP execution depending on file permissions.