The vulnerability is an improper control of the filename used in PHP include/require statements, allowing a local file inclusion (LFI) attack. The flaw may enable the attacker to read arbitrary files from the server or, if PHP code is included, execute arbitrary code, thereby compromising the confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites that use the ThemeREX Quanzo theme version 1.0.10 or earlier are affected.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of < 1% suggests that exploit attempts are currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local file inclusion triggered by undeclared or unsanitized filenames within the theme’s PHP code; the description infers that an attacker can supply a crafted path, read sensitive files or trigger PHP code execution if the included file contains executable code.