The Lingvico WordPress theme contains a flaw where the filename used in an include or require statement is not properly validated. This weakness, classified as CWE‑98, allows an attacker to specify an arbitrary file on the server. The potential to read sensitive configuration files or execute code is inferred from the nature of a local file inclusion flaw, although the CVE description does not explicitly state these outcomes.

WordPress installations that use the ThemeREX Lingvico theme up to and including version 1.0.14 are affected. Any site deploying those versions is vulnerable.

The vulnerability carries a CVSS score of 8.1, indicating high severity, while the EPSS score is below 1% and it is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request that controls the filename parameter used in the theme’s include or require statement, which is inferred from the description. Because the flaw is a local file inclusion that can be triggered by user input, an attacker could potentially compromise confidentiality, integrity, or availability of the affected site if they succeed in reading or executing files, but these consequences are inferred rather than explicitly stated.