The vulnerability in the ThemeREX Gridiron WordPress theme permits an attacker to include or require arbitrary local files. This improper control over filenames can lead to the execution of malicious code or the disclosure of sensitive server data, thereby compromising confidentiality, integrity, and availability of the affected system.

The issue affects ThemeREX Gridiron theme versions from any pre‑release up to and including 1.0.14. Users running these theme versions on a WordPress site are potentially impacted.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a currently low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves local exploitation through the theme’s file inclusion logic, but the exact method would depend on the attacker’s presence on the server or ability to influence theme configuration.