The vulnerability is an improper control of filenames for PHP include/require statements in the WordPress ProLingua theme, classified as a Local File Inclusion flaw. An attacker could supply a crafted input that causes the theme to include arbitrary local files, potentially leading to disclosure of sensitive configuration data or execution of malicious PHP code. The weakness aligns with CWE‑98: Improper Control of Filename for Include/Require Statement.

The issue affects ThemeREX ProLingua, a WordPress theme, across all releases up to and including version 1.1.12. Users running any of these versions are at risk.

The CVSS score of 8.1 indicates high severity. The EPSS rating of less than 1 % suggests low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur remotely through web requests containing manipulated parameters that influence the include path, though specific attack vectors are not explicitly detailed in the advisory.