An improper control of the filename used in a PHP include/require statement in ThemeREX Tint enables a local file inclusion flaw. This weakness, categorized as CWE-98, lets an attacker influence which file is read or executed by the application. If the attacker can supply a path to a sensitive file or a remote location, the flaw may expose confidential server data or allow execution of malicious code, potentially leading to full compromise of the WordPress site.

The vulnerability affects the ThemeREX Tint WordPress theme from all releases up to and including version 1.7. Any WordPress installation using this theme on its current or older versions is potentially vulnerable.

The vulnerability carries a CVSS score of 8.1, indicating a high severity level. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation at the current time. The flaw is not listed in the CISA KEV catalog. Attackers would likely trigger the LFI through a crafted web request that manipulates the filename parameter used by the theme, and no authentication prerequisite is documented, so the risk could be exploitible by unauthenticated users.