The vulnerability is an improper control of filename for include/require statements, allowing an attacker to cause a PHP Local File Inclusion. This flaw can enable the attacker to read sensitive files, execute code, or compromise the application, resulting in full compromise of the affected WordPress installation.

The bug impacts the ThemeREX Berger theme, version 1.1.1 and earlier. Any WordPress site that has this theme installed without updating to a newer release is vulnerable.

The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1 percent, suggesting exploitation is unlikely at present, and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is local user input that can manipulate the include path; if the web server permits write access to the file system or if the attacker can control configuration data, the flaw can lead to code execution. Although preliminary exploitation may be limited, the potential impact warrants prompt mitigation.