The vulnerability in the FreightCo WordPress theme stems from improper handling of filenames in PHP include/require statements. It is cataloged as a CWE‑98 Local File Inclusion flaw. The official description identifies the issue as a Local File Inclusion condition; the hypothesis that an attacker could elevate this to Remote Code Execution by supplying a crafted filename is inferred from the nature of the flaw and typical attack patterns, but it is not explicitly stated in the input.

ThemeREX's FreightCo WordPress theme versions up to and including 1.1.7 are affected. Users running any edition of this theme on their sites should verify the installed version; version 1.1.7 and any earlier releases are vulnerable.

With a CVSS score of 8.1 this flaw is high severity. The EPSS score of <1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw is a CWE‑98 Local File Inclusion; the attacker can manipulate a request that triggers the theme’s include logic. If the attacker can influence the filename, local files may be read, and remote code execution is possible depending on the server configuration. This inference about remote code execution is based on the nature of the flaw, not directly stated in the input.