The Hoverex WordPress theme uses an unsanitized filename in a PHP include/require call, a classic CWE‑98 flaw. An attacker can influence the value passed to the include/require routine. Successful exploitation can read any file that the web server’s process can access or inject PHP code, leading to code execution, data disclosure and a full compromise of confidentiality, integrity, and availability.

The flaw affects any WordPress site running the ThemeREX Hoverex theme version 1.5.10 or earlier. No later versions are reported as impacted in the advisory.

The base CVSS score is 8.1, classifying the vulnerability as high severity. The EPSS probability is less than 1 %, indicating a very low likelihood of exploitation in the current landscape, and it is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is manipulation of a request parameter that is forwarded directly to the vulnerable include/require call—e.g., a crafted URL that feeds a path into the PHP routine. Because no mitigations are described in the advisory, exploitation requires only that the attacker can craft such a request and that the web server user has permission to read the targeted file or execute injected code.