Improper control of the filename in a PHP include/require statement within the ThemeREX Global Logistics WordPress theme permits local file inclusion. An attacker who can influence the path parameter used by the theme can cause the server to read arbitrary local files or execute injected code, potentially exposing sensitive configuration files or executing arbitrary PHP scripts. This weakness is classified as CWE‑98 and can compromise the confidentiality, integrity, and availability of the website and underlying server.

All installations of the ThemeREX Global Logistics theme up to and including version 3.20 are vulnerable. The vendor is ThemeREX, and the affected product is the Global Logistics theme for WordPress. No specific sub‑versions are listed, so any version n/a through <= 3.20 is considered affected.

The CVSS base score of 8.1 indicates high severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation in the short term, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is local file inclusion driven by manipulated URL parameters or form inputs; successful exploitation requires the attacker to have the ability to supply a file path to the vulnerable function. If executed, the attacker could read sensitive files or achieve remote code execution.