The Cortex theme contains a PHP include/require statement that accepts a filename parameter directly from user input without proper validation, permitting an attacker to trigger a local file inclusion. This flaw allows inclusion of arbitrary local files and, if a PHP file is used, can facilitate remote code execution. The vulnerability, classified as CWE-98, applies to Cortex versions from the earliest release through 1.9.

The vulnerability affects the Mikado‑Themes Cortex WordPress theme for all releases up to and including version 1.9. Any website using Cortex 1.9 or earlier is at risk unless the theme is upgraded. No other WordPress components are known to be affected.

With a CVSS score of 8.1, this flaw is rated high severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, and it is not listed in CISA’s KEV catalog. Nonetheless, the vulnerability does not require privileged local access; an attacker can trigger it by sending a crafted HTTP request to a public endpoint that forwards the filename to the include/require call. The impact can range from information disclosure to full command execution if PHP files are included and executed.