This vulnerability in ThemeREX The Qlean theme allows improper handling of file names in PHP include/require statements, enabling a Local File Inclusion flaw. An attacker can trigger the theme to read arbitrary files from the underlying file system and, if the included file contains executable PHP, may also execute code. The issue aligns with CWE-98, leading to potential disclosure of sensitive information and code execution on the affected WordPress site.

The Qlean theme for WordPress, versions up to and including 2.12, distributed by ThemeREX, are affected. The vulnerability applies to all installations using any version n/a through 2.12.

The CVSS base score of 8.1 denotes high severity, while the EPSS score of less than 1% indicates the probability of exploitation is currently very low. The flaw is not listed in CISA’s KEV, implying no known widespread attacks. The likely attack vector is a Local File Inclusion capability that can be triggered via crafted requests to theme‑related endpoints or upload functions. Successful exploitation would require the attacker to control the file path used by the theme, making a local attacker or a remote attacker who can supply input to the theme a potential threat.