The vulnerability stems from an improper validation of filenames used in PHP include/require statements within the Manoir WordPress theme. This flaw, identified as CWE‑98, permits an attacker to cause the theme to include files that a legitimate user normally could not access. If the included files contain sensitive server data, the attacker may read them, and in configurations where PHP code in those files is executed, they may run arbitrary PHP code, potentially compromising the entire site and its underlying server.

WordPress installations that employ the Manoir theme from the first release through version 1.11 are affected. The vendor, ThemeREX, distributes the Manoir theme for WordPress.

With a CVSS score of 8.1, the vulnerability is high severity. An EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild at the time of assessment, and the issue is not catalogued in the CISA KEV list. The likely attack path involves a remote web request that supplies a crafted filename via a URL parameter or form input to the theme’s include logic; this inference comes from the description’s mention of an arbitrary filename being used without validation. Successful exploitation requires that the attacker can influence the include path; if the server permits execution of the included PHP code, remote code execution may result.