The Translogic theme contains an LFI flaw caused by an unsanitized filename supplied to PHP's include/require statement. If an attacker can supply a path that points to an arbitrary local file, the server will load and execute that file. This vulnerability is classified under "CWE‑98" and may lead to remote code execution if a malicious PHP script is included. Based on the description, it is inferred that including a malicious PHP file could lead to remote code execution. The description does not specify whether the attacker needs authenticated access; it is inferred that the attacker would need to influence the filename parameter, possibly via a crafted request to the theme.

ThemeREX Translogic Translogic, all releases up to and including version 1.2.11 are affected. The vendor is identified as ThemeREX:Translogic.

The CVSS base score of 8.1 indicates high severity. EPSS is reported as <1%, which suggests a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Theoretical exploitation requires an attacker capable of crafting a request that causes the theme to include a local file; successful exploitation can lead to code execution or data disclosure. Because the EPSS is low and it has not been observed in KEV, widespread active exploitation is unlikely at present, but the high CVSS and the nature of the flaw keep the risk significant for affected sites.