The vulnerability is caused by improper control of filenames used in PHP include/require statements in the ThemeREX Nuts theme. An attacker can manipulate the path argument to include arbitrary files from the filesystem, potentially executing attacker‑controlled code or exposing sensitive data. This vulnerability is classified as CWE‑98 and carries a CVSS score of 8.1, indicating a high risk level.

WordPress installations that employ ThemeREX Nuts version 1.10 or earlier are affected. Any site that has not upgraded past 1.10 remains at risk, independent of the WordPress core version.

The flaw is exploitably remote; the path can often be supplied directly in an HTTP request, allowing the attacker to include local files. The EPSS score of less than 1% reflects a low current probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Nevertheless, the high CVSS score and potential for code execution mean that sites should treat the vulnerability as critical if they can confirm an upgrade has not yet occurred. The attack vector is inferred to be remote via HTTP queries that manipulate the include path.