This vulnerability is an improper control of filename in a PHP include/require statement within the ThemeREX Maxify WordPress theme. The flaw allows an attacker to specify arbitrary file paths, causing the server to load files that may contain executable code. Based on this description, an attacker could potentially read local files on the server or other unintended content, leading to potential confusion or misuse of data. The weakness is identified as CWE-98.

ThemeREX Maxify versions up to 1.0.16 are affected. The vulnerability applies to all installations of the Maxify theme that have not been updated beyond version 1.0.16.

The CVSS score of 8.1 indicates high severity, but EPSS indicates the probability of exploitation is very low (<1%). The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit the flaw via crafted input that manipulates the include path, such as via poorly validated query parameters or configuration fields in the theme. The exploitation requires the application to allow the crafted input to reach an include/require statement without proper validation. The risk remains high until the theme is patched or the flaw is mitigated.