The Justitia theme contains an improper control of filename for an include/require statement in PHP. Because the filename is derived directly from input without validation, an attacker can cause the theme to include arbitrary files from the local filesystem. If PHP files are included, this can lead to remote code execution; if sensitive data files are exposed, confidentiality is impacted. The weakness corresponds to CWE-98.

ThemeREX Justitia theme versions up to and including 1.1.0 are affected. No specific sub‑versions are listed, so any 1.1.0 or earlier build must be considered vulnerable.

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS is listed as less than 1 %, so the likelihood of exploitation is currently low, and the issue is not listed in CISA’s KEV catalog. Nonetheless, the lack of input validation allows attackers to create crafted requests that reference arbitrary files on the server, potentially enabling data disclosure or code execution depending on server configuration.