The vulnerability is an improper control of filename for the PHP include or require statement in the ThemeREX Chroma WordPress theme. This flaw can allow an attacker to specify a file path that bypasses intended restrictions and is included by PHP. The result is a Local File Inclusion that enables attackers to read sensitive files on the server or, if they can supply a malicious PHP payload, subsequently execute arbitrary code. The impact spans confidentiality and integrity, and can grow to availability if the attacker causes a crash through mis‑crafted includes.

The affected product is the ThemeREX Chroma theme for WordPress, all versions from the earliest public release up through 1.11 inclusive. No specific patch version is supplied; the issue applies to every instance of the theme within that range.

The CVSS score of 8.1 denotes high severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit exists yet. The most likely attack vector is a web request to the WordPress site where the theme is active; the attacker would manipulate a query string or form input that is passed directly to an include/require call. No other prerequisite conditions are noted in the description.