This vulnerability is an unauthenticated Local File Inclusion flaw for the ThemeREX Snow Club WordPress theme in versions 1.1 and earlier. The theme accepts user input that is used directly in a file include request, allowing an attacker to read or execute arbitrary files on the web server. The fault can expose critical configuration settings, database credentials, and in the worst case facilitate remote code execution if a PHP file is included. The problem is identified as CWE‑98.

WordPress sites that have the ThemeREX Snow Club theme installed at version 1.1 or earlier are affected. Any site that continues to run these vulnerable theme versions remains at risk.

The flaw has a CVSS score of 8.1, indicating high severity. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified. Because the vulnerability is unauthenticated and requires no special privileges, any visitor can potentially trigger it. The vulnerability is not currently listed in CISA’s KEV catalog, but its high impact and lack of authentication make it a priority to address.