ThemeREX Meals & Wheels version 1.1.12 includes an improper control of filenames in PHP include/require statements. The flaw allows a user‑supplied path to be interpreted as a local file, enabling the reading of arbitrary files on the server. Based on the description, it is inferred that if an attacker can influence the include path to point to a PHP file, they may execute arbitrary code, potentially leading to remote code execution. The weakness corresponds to CWE‑98, highlighting a flaw in filename validation.

All installations of the Meals & Wheels WordPress theme from the initial release up through version 1.1.12 are affected. Any WordPress site using this theme within that version range could be exposed unless the theme has been updated to a fixed release.

The CVSS score of 8.1 indicates high severity. The EPSS score of < 1 % implies a very low probability of active exploitation at the time of analysis and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local to the web application, requiring an attacker to craft a request that passes a malicious path to an include/require call. Exploitation would likely involve manipulating a query parameter or form input that is directly forwarded to the include/require logic without proper sanitization.