The flaw involves improper control over the filename used in a PHP include/require statement within the WordPress ThemeREX R&F theme. Because the theme does not sanitize the file path, an attacker can manipulate it to read local files on the server, potentially exposing sensitive configuration data, credentials, or enabling the inclusion of malicious code that could lead to remote code execution. This weakness is classified as CWE‑98.

WordPress installations that use the ThemeREX R&F theme version 1.5 or older are affected. Any deployment with the R&F theme at or below version 1.5 can be exploited, while later releases are presumed to have the issue removed.

The CVSS score of 8.1 denotes a high severity, indicating potential compromise of confidentiality, integrity, and availability. The EPSS score of less than 1 percent signals that the vulnerability is unlikely to be actively exploited at present, and it is not listed in the CISA KEV catalog. Attackers could exploit the LFI by manipulating configuration options or request parameters that the theme processes for file inclusion, but would need some level of access to the WordPress admin interface or the ability to influence theme settings.