The bug is an improper control of the filename used in a PHP include or require statement inside the ThemeREX ConFix WordPress theme. An attacker who can influence the filename may cause the theme to include and execute code from any local file that the web server can access, leading to confidentiality and integrity compromise of the site.

The ConFix theme, as distributed by ThemeREX, is affected in all releases up to and including version 1.013. Any WordPress website that has installed one of those versions of the theme is vulnerable; the flaw does not depend on the PHP interpreter or web server configuration beyond the presence of the theme files.

The CVSS base score of 8.1 indicates a high severity vulnerability, yet the EPSS score is below 1% and it is not listed in the CISA KEV catalog, implying that widespread exploitation is unlikely at this time. The likely attack vector is a remote attacker sending a crafted request that propagates a user‑controlled string into the filename used in the include/require call; this inference is drawn from the description of how the filename is not properly validated. If successful, the attacker could read sensitive configuration files or run arbitrary PHP code residing on the file system.