The Humanum theme contains an improper control of the filename used in PHP include/require statements, which can be exploited to perform local file inclusion. This flaw is classified as CWE-98 and can allow an attacker to read sensitive files on the server, expose configuration and credential data, and, if the included file contains executable code or the application accepts user input that is executed as code, may lead to remote code execution. The primary impact is the loss of confidentiality and integrity of the host environment, and potentially full system compromise.

WordPress installations that use the ThemeREX Humanum theme, including all released versions up to and including 1.1.4. No later versions are known to be affected.

The vulnerability carries a CVSS score of 8.1, indicating a high severity. The EPSS score is less than 1%, implying that, although the flaw is severe, the likelihood of successful exploitation is currently low. The flaw has not been listed in the CISA KEV catalog. The most plausible attack vector is remote; the flaw can be triggered by a crafted HTTP request that results in the theme including an arbitrary local file. While no direct exploitation code is listed, local file inclusion can be leveraged for data theft or to plant malicious code if the attacker can influence the inclusion path.