The ShiftCV theme from ThemeREX contains an improper control of filenames used in PHP include/require statements. This flaw permits an attacker to specify arbitrary file paths, which leads to local file inclusion. By including a file that contains PHP code, the attacker could also trigger execution of that code within the context of the web application.

The vulnerability affects every release of the ShiftCV theme distributed by ThemeREX up to and including version 3.0.14. Users running any of these versions should consider upgrading.

With a CVSS score of 8.1, the flaw is considered high severity. The EPSS score of less than 1% indicates a very low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via a crafted HTTP request that manipulates a filename used in a PHP include/require statement; a local attacker with file system access could also trigger the flaw by directly supplying a path.