The vulnerability arises from an improper control of filename for include/require statements in the ThemeREX Plank theme. The flaw, identified as CWE‑98, permits an attacker to influence the filename that the PHP include/require functions load. An attacker can thus read or execute arbitrary local files through the theme’s code, a path that may lead to remote code execution if a malicious file is served.

WordPress installations that use the ThemeREX Plank theme with any version from the earliest release through version 1.7 inclusive are affected. The vendor is ThemeREX, product Plank. Sites running these versions have the vulnerable include logic in the theme’s PHP files.

The CVSS score of 8.1 reflects high severity. The EPSS score of less than 1% indicates that, as of this analysis, exploitation is unlikely to be observed in the wild, and it is not listed in the CISA KEV catalog. However, the weakness allows an unauthenticated attacker to influence the local file inclusion path, which could be leveraged to read sensitive files or inject code via PHP files, potentially achieving full site compromise if additional conditions (such as permissive file permissions) are met. The most likely attack vector involves manipulating a URL or form input that controls the filename used in the theme’s include logic, with the attack launched from any site accessible to the attacker.