The vulnerability is an improper control of filenames in PHP include/require statements within the RT-Theme 18 | Extensions plugin. An attacker can craft a request that forces the plugin to include arbitrary local files, potentially exposing sensitive data or enabling execution of malicious code. This weakness falls under CWE-98 and fundamentally threatens confidentiality, integrity, and potentially availability of the affected WordPress site.

RT-Theme 18 | Extensions, a WordPress plugin by stmcan, is affected in all releases from the initial release through version 2.4. The issue involves the built‑in file inclusion logic of the plugin and therefore impacts any WordPress installation deploying this plugin in those versions.

The CVSS score of 7.5 indicates a high severity potential for exploitation. The EPSS score of less than 1% suggests that, as of the latest data, the probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, reducing immediate threat awareness. Based on the description, the attack vector is likely an authenticated or arbitrary file path exploitation that could be triggered by a user with write access to the plugin’s configuration or via a crafted URL. Exact prerequisites are not detailed in the data, so a cautious stance is recommended.