WordPress Chronicle - Lifestyle Magazine & Blog WordPress Theme theme <= 1.0 - Local File Inclusion vulnerability

The Chronicle WordPress theme has a vulnerability that lets attackers read or execute files from the server by manipulating file path inputs. This happens because the theme doesn't properly validate what files it includes, potentially exposing sensitive information or allowing malicious code execution.

The vulnerability is a PHP Local File Inclusion (LFI) flaw arising from improper input validation on filename parameters used in include/require statements (CWE-98). An attacker can supply crafted file paths to access arbitrary files on the server; exploitation requires the ability to influence the affected input parameters, and successful exploitation may lead to information disclosure or code execution depending on accessible files and server configuration.