An unauthenticated local file inclusion flaw exists in the Nexio theme for WordPress versions up to and including 1.10.0. The vulnerability allows an attacker to instruct the application to read any file on the server by manipulating a file inclusion request. This can expose sensitive configuration files, private credentials, or any other data stored on the host, and in some cases could allow the execution of arbitrary code if an executable file is read and triggered. The weakness is a classic example of CWE‑98, where unchecked input is used to construct a path to a file on the filesystem.

All WordPress installations that use the ThemeREX Nexio theme version 1.10.0 or older are affected. The issue is confined to those sites that have not upgraded their theme beyond the stated boundary.

The vulnerability scores a CVSS of 8.1, denoting a high severity level. Its EPSS score of less than 1% indicates that, while the probability of exploitation is low, the flaw remains serious enough to warrant immediate attention. The vulnerability is not listed in CISA’s KEV catalog, but because it is unauthenticated, a remote attacker could potentially trigger the inclusion by accessing the website. The attack would require sending a crafted request to the vulnerable endpoint, after which the attacker could retrieve arbitrary files from the server.