ThemeREX Nelson 1.2.0 and earlier contain an improper control of the filename used in PHP include/require statements. This weakens the application to arbitrary file inclusion via the PHP interpreter. An attacker can supply a path that resolves to local files on the server and read sensitive data or, if a writable file is exposed, upload and execute arbitrary PHP code. The weakness corresponds to CWE‑98 “Improper Control of Filename”. The resulting impact is the potential compromise of confidentiality, integrity, and availability of the WordPress site.

The vulnerability affects WordPress installations that use the ThemeREX Nelson theme up to and including version 1.2.0. Any site running these versions can be impacted; no other PHP frameworks or themes are formally listed.

With a CVSS score of 8.1 the vulnerability is classified as high severity. The EPSS score of less than 1% indicates a low probability that it is actively exploited in the wild, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, the attack vector is likely remote and can be performed by providing a crafted URL or input parameter that influences the include/require path. Due to this remote nature, the vulnerability poses a significant risk for organizations with exposed WordPress sites that have not applied the latest theme updates.