The Fortius theme up to version 2.3.0 contains a local file inclusion flaw that does not require authentication, allowing an attacker to read files that the web server can access. The vulnerability is a classic CWE‑98 flaw and provides the attacker the ability to obtain information from the server, potentially including sensitive configuration or other data. No specific files are mentioned in the CVE record; the impact is inferred to be the potential disclosure of whatever files the attacker can path‑traverse to and that are readable by the web process.

WordPress sites that have installed ThemeREX Fortius theme version 2.3.0 or earlier are affected. The issue is confined to the theme’s code and does not affect the core WordPress files unless the theme is active.

The CVSS score of 8.1 labels this a high‑severity vulnerability, and the lack of an authentication requirement means the flaw can be exploited remotely via crafted URLs. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. If an attacker can reach the vulnerable theme’s inclusion code, exploitation is likely and can lead to information disclosure. Proper deployment of the latest theme version or removal of the theme mitigates the risk.