The Cortex theme contains a PHP include/require statement that accepts a filename parameter directly from user input without proper validation. This lack of input sanitization allows a remote attacker to craft requests that cause the server to include arbitrary local files. The resulting local file inclusion can be used to read sensitive configuration files, database credentials, or user uploads, and, if the included file contains executable PHP code, may lead to remote code execution. The weakness is classified as CWE-98.

The vulnerability affects the Mikado‑Themes Cortex WordPress theme for all releases up to and including version 1.5. Any website using Cortex 1.5 or earlier is at risk unless the theme is upgraded. No other WordPress components are known to be affected.

The CVSS score of 8.1 categorizes this flaw as high severity. Although current evidence indicates a low exploitation likelihood, the attack does not require privileged local access; an attacker can trigger it by sending a crafted HTTP request to a public endpoint that forwards the filename to the include/require call. The impact can range from information disclosure to full command execution if the server permits executing PHP from the included file.