The Spike theme for WordPress contains an unauthenticated Local File Inclusion vulnerability that allows an attacker to read arbitrary files on the victim server. This weakness is catalogued as CWE-98, meaning that the application fails to correctly restrict the inclusion of files specified by user input. If an attacker can supply a path that points to sensitive files, they could gain access to configuration files, credentials, or other confidential data. In the worst case, an attacker who can read arbitrary files might also pivot to further exploitation techniques that could compromise the whole site.

Themes released by ThemeREX, specifically the Spike theme version 1.2 and earlier. No other vendors or products are listed as affected, and no specific version range beyond 1.2 was provided in the CNA data.

The CVSS score of 8.1 indicates a high severity level, while the EPSS score of less than 1% shows that exploitation is not common but remains possible. The vulnerability is not included in the CISA KEV catalog, so there is no evidence of large‑scale exploitation yet. Attackers can trigger the LFI without authentication; the exact method to supply the malicious path is not disclosed in the description, but based on typical LFI behavior in WordPress themes it is inferred that an attacker could manipulate a URL parameter or form input that the theme uses when including files. Because the LFI is unauthenticated and can expose files outside the web root, any attacker who gains read access to arbitrary files might also pivot to further exploitation techniques that compromise the entire site.