WordPress Woopy theme <= 1.2 - Local File Inclusion vulnerability

The Woopy WordPress theme up to version 1.2 contains a vulnerability that allows attackers to include and execute local files on the server. This can lead to unauthorized access to sensitive files or remote code execution if exploited.

CWE-98 (improper control of filename for include/require statements) in Woopy <= 1.2 allows local file inclusion (LFI) through inadequately sanitized include/require parameters. An attacker with web access can manipulate file path inputs to include arbitrary local files, potentially leading to information disclosure or code execution depending on file accessibility and context.