The Splendour WordPress theme contains an improper control of filename for include/require statements in PHP, allowing local file inclusion. An attacker can supply a crafted file path to the vulnerable code and read or execute arbitrary local files on the server, which could disclose sensitive information or compromise the site if the included file contains executable code.

Any installation of the ThemeREX Splendour WordPress theme from the earliest release up to and including version 1.23 is potentially affected. Users should verify which version they are running and note that the issue does not apply to versions 1.24 or later.

The vulnerability scores a CVSS of 8.1, indicating high severity, while the EPSS score is less than 1%, suggesting a lower likelihood of exploitation at this time and it is not listed in the CISA KEV catalog. The likely attack vector is via the theme's file inclusion logic, which can be triggered by a specially crafted request to the site. Although public exploitation evidence is lacking, the high CVSS warrants prompt remediation to prevent possible data exposure or further compromise.